FreshPorts - VuXML

The Tor Project reports:

Tor 0.3.0.9 fixes a path selection bug that would allow a client to use a guard that was in the same network family as a chosen exit relay. This is a security regression; all clients running earlier versions of 0.3.0.x or 0.3.1.x should upgrade to 0.3.0.9 or 0.3.1.4-alpha.

< 0.3.0.9

< 0.3.1.4.a

Secunia reports:

A vulnerability with an unknown impact has been reported in Tor.

The vulnerability is caused due to an unspecified error and can be exploited to trigger a heap corruption. No further information is currently available.

< 0.2.0.33

< 0.2.1.11-alpha

The Tor Project reports:

Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAY_EARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAY_EARLY cells as a means of communicating information about hidden service names.

< 0.2.4.23

< 0.2.5.6.a

The Torproject.org reports:

• TROVE-2017-009: Replay-cache ineffective for v2 onion services
• TROVE-2017-010: Remote DoS attack against directory authorities
• TROVE-2017-011: An attacker can make Tor ask for a password
• TROVE-2017-012: Relays can pick themselves in a circuit path
• TROVE-2017-013: Use-after-free in onion service v2

< 0.3.1.9

The Tor Project reports:

A remote heap overflow vulnerability that can allow remote code execution. Other fixes address a variety of assert and crash bugs, most of which we think are hard to exploit remotely. All Tor users should upgrade.

< 0.2.1.29

< 0.2.2.21.a

The Tor Project reports:

Remotely exploitable bug that could be used to crash instances of Tor remotely by overflowing on the heap. Remote-code execution hasn't been confirmed, but can't be ruled out. Everyone should upgrade.

< 0.2.1.28

< 0.2.2.20-alpha

Tor organization reports:

TROVE-2022-001

< 0.4.7.8

A tor advisory reports

Tor clients can completely loose anonymity, confidentiality, and data integrity if the first Tor server in their path is malicious. Specifically, if the Tor client chooses a malicious Tor server for her first hop in the circuit, that server can learn all the keys she negotiates for the rest of the circuit (or just spoof the whole circuit), and then read and/or modify all her traffic over that circuit.

< 0.1.0.14

Roger Dingledine reports:

The Tor 0.1.0.10 release from a few days ago includes a fix for a bug that might allow an attacker to read arbitrary memory (maybe even keys) from an exit server's process space. We haven't heard any reports of exploits yet, but hey.

< 0.1.0.10

Secunia reports:

Some vulnerabilities have been reported in Tor, where one has an unknown impact and others can be exploited by malicious people to cause a DoS.

An error when running Tor as a directory authority can be exploited to trigger the execution of an infinite loop.

An unspecified error exists when running on Windows systems prior to Windows XP. No further information is currently available.

< 0.2.0.34

< 0.2.12-alpha

The Tor Project reports:

TROVE-2022-002: The SafeSocks option for SOCKS4(a) is inverted leading to SOCKS4 going through

This is a report from hackerone:

We have classified this as medium considering that tor was not defending in-depth for dangerous SOCKS request and so any user relying on SafeSocks 1 to make sure they don't link DNS leak and their Tor traffic wasn't safe afterall for SOCKS4(a). Tor Browser doesn't use SafeSocks 1 and SOCKS4 so at least the likely vast majority of users are not affected.

< 0.4.7.13

Tor has various remote crashes which could lead to a remote denial-of-service and be used to defeat clients anonymity. It is not expected that these vulnerabilities are exploitable for arbitrary code execution.

< 0.0.8.1

The Tor Blog reports:

Prevent a class of security bugs caused by treating the contents of a buffer chunk as if they were a NUL-terminated string. At least one such bug seems to be present in all currently used versions of Tor, and would allow an attacker to remotely crash most Tor instances, especially those compiled with extra compiler hardening. With this defense in place, such bugs can't crash Tor, though we should still fix them as they occur. Closes ticket 20384 (TROVE-2016-10-001).

< 0.2.8.9

< 0.2.9.4-alpha

Roger Dingledine reports:

If you offer a Tor hidden service, an adversary who can run a fast Tor server and who knows some basic statistics can find the location of your hidden service in a matter of minutes to hours.

< 0.1.0.12