CVE-2021-38385

Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007...

CVE-2021-38385

Tor vulnerable in versions before 0.3.5.16, 0.4.5.10, and 0.4.6.7 due to mishandling the relationship between batch-signature and single-signature verification, causing remote assertion failures (TROVE-2021-007). Connected advisories confirm the issue across multiple distributions and recommend u...

CVE-2021-38385

Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007...

openSUSE 15 Security Update : tor (openSUSE-SU-2021:1169-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:1169-1 advisory. - Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification,...

Design/Logic Flaw

An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can trigger the use of an attacker-chosen circuit ID to cause algorithm inefficiency...

CVE-2021-34548

An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAYEND or RELAYRESOLVED to bypass the intended access control for ending a stream...

Information disclosure

An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAYEND or RELAYRESOLVED to bypass the intended access control for ending a stream...

CVE-2021-34550

Tor before 0.4.6.5 has a vulnerability in the v3 onion service descriptor parser that allows out-of-bounds memory access, causing client crashes. The issue is documented as CVE-2021-34550. Connected advisories indicate the vulnerability could lead to denial of service for relays/clients and that ...

CVE-2021-34550

An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006. The v3 onion service descriptor parsing allows out-of-bounds memory access, and a client crash, via a crafted onion service descriptor...

CVE-2021-34549

CVE-2021-34549 affects Tor prior to 0.4.6.5. The issue is a hashtable-based CPU denial-of-service attack against relays: an attacker can exploit a naive, unkeyed hash used to look up circuits in a circuitmux to construct circuits with chosen circuit IDs, causing collisions and degraded performanc...

CVE-2021-34548

The CVE-2021-34548 entry pertains to Tor up to version 0.4.6.5 (TROVE-2021-003). Affected component: Tor relay/stream handling where an attacker can forge RELAY_END or RELAY_RESOLVED to bypass access control on half‑closed streams, potentially terminating streams or impacting availability. Impact...

CVE-2021-34548

An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAYEND or RELAYRESOLVED to bypass the intended access control for ending a stream...

Design/Logic Flaw

Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001...

Code injection

Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002...

CVE-2021-28089

Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001...

CVE-2021-28090

Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002...

CVE-2021-28089

CVE-2021-28089 affects Tor before 0.4.5.7, enabling a remote participant in the Tor directory protocol to exhaust CPU resources on a target (denial of service). Connected advisories trace the issue to a memory/CPU handling flaw (dump_desc() dumping unparseable data) and related directory‑consensu...

CVE-2021-28089

Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001...

CVE-2021-28089

Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001...

openSUSE Security Update : tor (openSUSE-2020-1970)

This update for tor fixes the following issues : Updating tor to a newer version in the respective codestream. - tor 0.3.5.12 : - Check channels+circuits on relays more thoroughly TROVE-2020-005, boo1178741 - Not affected by out-of-bound memory access CVE-2020-15572, boo1173979 - Fix DoS defenses...