Out-of-bounds

The networkstatusparsevotefromstring function in routerparse.c in Tor before 0.2.2.38 does not properly handle an invalid flavor name, which allows remote attackers to cause a denial of service out-of-bounds read and daemon crash via a crafted 1 vote document or 2 consensus document...

CVE-2012-3518

Tor before 0.2.2.38 has a vulnerability in networkstatus_parse_vote_from_string when handling an invalid flavor name, enabling a remote attacker to trigger an out-of-bounds read and daemon crash via crafted vote or consensus documents. Affected versions are prior to 0.2.2.38; remediation is to up...