Command injection

The connectionedgeprocessrelaycell function in or/relay.c in Tor before 0.2.3.25 maintains circuits even if an unexpected SENDME cell arrives, which might allow remote attackers to cause a denial of service memory consumption or excessive cell reception rate or bypass intended flow-control...