log uninitialized stack in non-default configuration [CVE-2017-0380]

Debian Bug report logs - #876221
log uninitialized stack in non-default configuration [CVE-2017-0380]

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Peter Palfrader <weasel@debian.org>

To: submit@bugs.debian.org

Subject: log uninitialized stack in non-default configuration [CVE-2017-0380]

Date: Tue, 19 Sep 2017 19:20:12 +0000

Package: tor
Severity: serious
Version: 0.2.7.2-alpha-1
Control: forwarded -1 https://bugs.torproject.org/23490

tor could log uninitialized stack when a certain hidden service error occurred
while SafeLogging was disabled.

This is also tracked as TROVE-2017-008 and CVE-2017-0380.

-- 
                            |  .''`.       ** Debian **
      Peter Palfrader       | : :' :      The  universal
 https://www.palfrader.org/ | `. `'      Operating System
                            |   `-    https://www.debian.org/

Message #16 received at 876221-done@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: Peter Palfrader <weasel@debian.org>

Subject: tor_0.3.1.7-1_weasel.changes ACCEPTED into unstable

Date: Wed, 20 Sep 2017 09:39:11 +0000

[Message part 1 (application/pgp, inline)]

Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Mon, 18 Sep 2017 23:01:50 +0200
Source: tor
Binary: tor tor-geoipdb
Architecture: source
Version: 0.3.1.7-1
Distribution: unstable
Urgency: medium
Maintainer: Peter Palfrader <weasel@debian.org>
Changed-By: Peter Palfrader <weasel@debian.org>
Description:
 tor        - anonymizing overlay network for TCP
 tor-geoipdb - GeoIP database for Tor
Changes:
 tor (0.3.1.7-1) unstable; urgency=medium
 .
   * New upstream version, upload 0.3.1.x tree to unstable.
   * Build depend on liblzma-dev and libzstd-dev.
Checksums-Sha1:
 4d69471adb52de0fbfa04af3f77c170235f2b266 1800 tor_0.3.1.7-1.dsc
 9a675add1e20ef0eb624c03db71b9f5a506a445d 6058284 tor_0.3.1.7.orig.tar.gz
 4c7c8183f5e747883064352fd6d1b121c6471cba 47818 tor_0.3.1.7-1.diff.gz
Checksums-Sha256:
 4c386f550f8838f7a11adb2cdedf7b5cc120c677f366637f1714d959ef6815c1 1800 tor_0.3.1.7-1.dsc
 1df5dd4894bb2f5e0dc96c466955146353cf33ac50cd997cfc1b28ea3ed9c08f 6058284 tor_0.3.1.7.orig.tar.gz
 6ecdd21021e0eb9139c26abd385b9fc968a5651ee74e34cc2e064938ead84eb3 47818 tor_0.3.1.7-1.diff.gz
Files:
 3d260898dd70fce67e13db0877ebdb2d 1800 net optional tor_0.3.1.7-1.dsc
 ec7c9f588c9e1a42c09bcc097a1e55eb 6058284 net optional tor_0.3.1.7.orig.tar.gz
 fb8ac7369b5e54ac3efdbbff6228a6f7 47818 net optional tor_0.3.1.7-1.diff.gz

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEs4PXhajJL968BgN2hgLIIDhyMx8FAlnCMhsACgkQhgLIIDhy
Mx+8lQgAtpKbXxDsCG382T84kvC0ddIbzFky71Va2iKIcLuUvbzGdNtL1hc6bfTt
zqnHy08vyVtWST1euiwX1sNlQNvSnV34BI3QX95xUXyOXpk6ytX1fcIWzUJO1jZF
Zwo8lk671PNjR7tbHiU5SYqzJOhDIkuySMJjzB4X6765YLkicYjZg3TJhdHADKUq
YXf5SK61LNYMi/80K4H27qJK3YjFgOYEpm22Zf8kT0ayTqgIcRMMt8W3+6POZFNb
qCobV86MPIaJ4796Y34rMycowL6MWTHC3YwoffYTrK803wnq5oT9U7lEI9cNQ7Pz
LDC+rUo5sSejmuqmVOLdq54l50boBg==
=o9gS
-----END PGP SIGNATURE-----


Thank you for your contribution to Debian.

Send a report that this bug log contains spam.