Debian Bug report logs -
#848847
tor: CVE-2016-1254 (TROVE-2016-12-002): read past allocated buffer in hidden service descriptor parsing
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org:
Bug#848847; Package tor.
(Tue, 20 Dec 2016 07:03:04 GMT) (full text, mbox, link).
Acknowledgement sent
to Peter Palfrader <weasel@debian.org>:
New Bug report received and forwarded.
(Tue, 20 Dec 2016 07:03:04 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Package: tor
Version: 0.2.0.8-alpha-1
Severity: serious
It has been discovered that Tor may read one byte past an allocated
buffer while parsing hidden service descriptors.
This may enable a malicions hidden service to crash clients attempting
to access it in some circumstances.
--
| .''`. ** Debian **
Peter Palfrader | : :' : The universal
https://www.palfrader.org/ | `. `' Operating System
| `- https://www.debian.org/
Reply sent
to Debian FTP Masters <ftpmaster@ftp-master.debian.org>:
You have taken responsibility.
(Tue, 20 Dec 2016 07:12:04 GMT) (full text, mbox, link).
Notification sent
to Peter Palfrader <weasel@debian.org>:
Bug acknowledged by developer.
(Tue, 20 Dec 2016 07:12:04 GMT) (full text, mbox, link).
Message #10 received at 848847-done@bugs.debian.org (full text, mbox, reply):
[Message part 1 (application/pgp, inline)]
Accepted:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Mon, 19 Dec 2016 15:53:38 +0100
Source: tor
Binary: tor tor-dbg tor-geoipdb
Architecture: source
Version: 0.2.9.8-1
Distribution: experimental
Urgency: medium
Maintainer: Peter Palfrader <weasel@debian.org>
Changed-By: Peter Palfrader <weasel@debian.org>
Description:
tor - anonymizing overlay network for TCP
tor-dbg - debugging symbols for Tor
tor-geoipdb - GeoIP database for Tor
Changes:
tor (0.2.9.8-1) experimental; urgency=medium
.
* New upstream version, upload 0.2.9.x tree to unstable.
* Add a comment to tor@.service explaining why we cannot limit to
/var/lib/tor-instances/<instance> but only to /var/lib/tor-instances --
systemd does not do instance expansion in ReadWriteDirectories lines --
cf. #781730.
* Update README.Debian to mention a good location to put onion service
UNIX sockets. Note that neither systemd nor apparmor limits access
to them -- cf. #846275.
* Use -Z (Apply SE-Linux labels) to install when creating instance datadirs
in tor-instance-create.
Checksums-Sha1:
80be9657016c9760ce897fd10443590e43df45ca 1820 tor_0.2.9.8-1.dsc
02364a45486ea70e3cdfdf2a195ae7501f0a5f26 5522235 tor_0.2.9.8.orig.tar.gz
70daa4cc8e9ca66f2bc85bc74193845e58c5e4bb 41446 tor_0.2.9.8-1.diff.gz
Checksums-Sha256:
2431c125054627848e6ae89bc41f66dc22ea1fe5c97a1d656ab48a7165267781 1820 tor_0.2.9.8-1.dsc
fbdd33d3384574297b88744622382008d1e0f9ddd300d330746c464b7a7d746a 5522235 tor_0.2.9.8.orig.tar.gz
eb6d9382cd91e9ceb967a291e63548e0e7045586b3841071deabdbc56cd8be37 41446 tor_0.2.9.8-1.diff.gz
Files:
a3773a2fc8def681a2cdfe035da1e1b2 1820 net optional tor_0.2.9.8-1.dsc
1fb879608c5237294cb7e682e486b073 5522235 net optional tor_0.2.9.8.orig.tar.gz
a0b97c1ca94075449b9b1afe0a34a739 41446 net optional tor_0.2.9.8-1.diff.gz
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAEBCAAGBQJYWEkZAAoJEIYCyCA4cjMfg9sIAMStHsiyS6uveq5fs3hLPMcb
PxD8Z/wJd8ot8R4QcWlqIGh6kJb0BY7BSRYy141hQ3oMB7AcMGkNZSXtqGpNuaFU
jA6xl8DZOXyzup5Zj8qruqd8JF3Sw0vzfa4FH85JtumUUGANngWWfpk8n9hsl+c+
lxc7GWRjHCWHixuJqd2wXsdRmBCj3o1b5BTd2CFiBfM4UyuG+HMTJRqNXQoLeMIy
8NkvuxXDCiJ791+Y1lq+3GDzbhGg/N9/i5LVJOja0uW/DXUb98E/8y2X6to2fayi
3xfIwD6tGnccvsWa0KQDMZhuvaujvO7oYy+bMJ5/OMp2ylTv3j791b3u3nxVSLk=
=sjnH
-----END PGP SIGNATURE-----
Thank you for your contribution to Debian.
Marked as fixed in versions tor/0.2.9.8-1.
Request was from Paul Wise <pabs@debian.org>
to control@bugs.debian.org.
(Tue, 20 Dec 2016 07:15:02 GMT) (full text, mbox, link).
Changed Bug title to 'tor: CVE-2016-1254 (TROVE-2016-12-002): read past allocated buffer in hidden service descriptor parsing' from 'read past allocated buffer in hidden service descriptor parsing'.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org.
(Tue, 20 Dec 2016 07:33:09 GMT) (full text, mbox, link).
Message #17 received at 848847-done@bugs.debian.org (full text, mbox, reply):
[Message part 1 (application/pgp, inline)]
Accepted:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Mon, 19 Dec 2016 22:01:22 +0100
Source: tor
Binary: tor tor-dbg tor-geoipdb
Architecture: source all
Version: 0.2.5.12-4
Distribution: jessie-security
Urgency: medium
Maintainer: Peter Palfrader <weasel@debian.org>
Changed-By: Peter Palfrader <weasel@debian.org>
Description:
tor - anonymizing overlay network for TCP
tor-dbg - debugging symbols for Tor
tor-geoipdb - GeoIP database for Tor
Changes:
tor (0.2.5.12-4) jessie-security; urgency=medium
.
* Fix for an issue (Tor#21018) where Tor clients could crash when
attempting to visit a hostile hidden service.
[TROVE-2016-12-002,CVE-2016-1254]
Checksums-Sha1:
37c40667328778a4ff78378c9b0477b262e79492 1761 tor_0.2.5.12-4.dsc
1012c41c470e108c9ad77f94240b25bd5f2f7bcd 38710 tor_0.2.5.12-4.diff.gz
3d7c475e00b022141248e206aa9343b000fc0a4e 815082 tor-geoipdb_0.2.5.12-4_all.deb
Checksums-Sha256:
ff1491c96380ec16c77d272b33832dbc4d586c4e8095dc25c9aadec381e9d46b 1761 tor_0.2.5.12-4.dsc
42e62e0729c3f8c2773e58bcbf5537339da855c97d18703553de145b17d054cc 38710 tor_0.2.5.12-4.diff.gz
3ea2648b289e86522400a6491200de334c5dd8729236be2b92ea89e46de28b66 815082 tor-geoipdb_0.2.5.12-4_all.deb
Files:
856c619c5e36c32e1581b692f0bb14fb 1761 net optional tor_0.2.5.12-4.dsc
a863741884d56af0eedb78eca4ebac9c 38710 net optional tor_0.2.5.12-4.diff.gz
8d13cfcc3c2eb96656c4519cbd1d11df 815082 net extra tor-geoipdb_0.2.5.12-4_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAEBCAAGBQJYWE/fAAoJEIYCyCA4cjMfuyoH/1reH8m+c+NrmWRuWI4PWChz
jnR4bYv7NWNwzwdgOCaaKnqOEohTfWBF2BUebXQV3DdNZq7dtvVNq17saxiXEFHB
SjCGrSAhZO4dLsKfImyQ/cLqB08VJ2olsOmoE1ywZ4SDH7F1+JiJgB6erm6/tRHz
v7ziYlmD2h9aYNnUxYD+cA9iM3wYPn+2Y1cijedLPeM/p2NjVLKydv7Qu0cmJlvO
RnjjGTd8sSXOD5KNKMIm+ztncIdbIvB58991/s01UF05S0WF51zRrnmm2GF7FxC2
9SJS9Ryf/6NfB5vplVoAz08uSBNFFx023DojNsHy6LZBkIpk1uMrjTzQC5vE1cM=
=j2eL
-----END PGP SIGNATURE-----
Thank you for your contribution to Debian.
Marked as fixed in versions 0.2.5.12-4.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org.
(Tue, 20 Dec 2016 12:09:04 GMT) (full text, mbox, link).
Message sent on
to Peter Palfrader <weasel@debian.org>:
Bug#848847.
(Tue, 20 Dec 2016 12:09:07 GMT) (full text, mbox, link).
Message #22 received at 848847-submitter@bugs.debian.org (full text, mbox, reply):
close 848847 0.2.5.12-4
thanks
Marked as fixed in versions 0.2.4.27-3.
Request was from Peter Palfrader <weasel@debian.org>
to control@bugs.debian.org.
(Tue, 20 Dec 2016 12:33:06 GMT) (full text, mbox, link).
Message #25 received at 848847-done@bugs.debian.org (full text, mbox, reply):
[Message part 1 (application/pgp, inline)]
Accepted:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Mon, 19 Dec 2016 22:01:22 +0100
Source: tor
Binary: tor tor-dbg tor-geoipdb
Architecture: source all
Version: 0.2.4.27-3
Distribution: wheezy-security
Urgency: medium
Maintainer: Peter Palfrader <weasel@debian.org>
Changed-By: Peter Palfrader <weasel@debian.org>
Description:
tor - anonymizing overlay network for TCP
tor-dbg - debugging symbols for Tor
tor-geoipdb - GeoIP database for Tor
Changes:
tor (0.2.4.27-3) wheezy-security; urgency=medium
.
* Fix for an issue (Tor#21018) where Tor clients could crash when
attempting to visit a hostile hidden service.
[TROVE-2016-12-002,CVE-2016-1254]
Checksums-Sha1:
39e0a65e1acc3b3e3eb1118bee81efd7dead3674 1693 tor_0.2.4.27-3.dsc
998bdc3c086e8ec32455061f555984f9a5e19286 38997 tor_0.2.4.27-3.diff.gz
6045414538bf0890dafe1192b62c951733310c05 1199948 tor-geoipdb_0.2.4.27-3_all.deb
Checksums-Sha256:
99eee0b7ee20dfcc1b16147d0b9719dfc663eae631eef4a5b82647d1b036befe 1693 tor_0.2.4.27-3.dsc
d4482c84003befea88d8995ced15e88d1c7d445bfe2545560627473029d9ecff 38997 tor_0.2.4.27-3.diff.gz
fc401b0640b69f51149626fffa3be33f9fe59dd5c523803e30c18e1feef7ad41 1199948 tor-geoipdb_0.2.4.27-3_all.deb
Files:
84bb4490e1b1ef9043aa9a380ab2de95 1693 net optional tor_0.2.4.27-3.dsc
d19edaa242552f1d849f29d5377f34e1 38997 net optional tor_0.2.4.27-3.diff.gz
90ef0664f0f4355808f13ccfba5424cb 1199948 net extra tor-geoipdb_0.2.4.27-3_all.deb
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCAAdFiEEs4PXhajJL968BgN2hgLIIDhyMx8FAlhZGrwACgkQhgLIIDhy
Mx/P6Af7BZPL/VhX1IVN/CfLXVH0LBzvXCGoZziJu+TW8HxsP9/BRIwRpbSN2zVa
zBz0iUSUHOlN5dXGyPyALAmuD4L3Bx9xUqP4Uzuzn9B30XRt6mt4vPAJPsro0dYJ
1a/WW7NbFF+X/rd/Q5AmSwXHtfvqkWB6ZaNy25fgWTmxW4w1t8fpie5ck4QRYuwq
vEIw+BCiGzCuEogoKsgqwHTS2k+Y4gAb6fLhaOT0AAmZ08kygVDvPoLAItd/lEBl
3f0/G8NocRN/7TqtE87O1tIlhR/9ilqNtS5S4I6ib9TkVGR7ryVFkUmiPUvGGP5N
1/YKtSCM4iXp1yX/E8zFLUCi0A7Eag==
=U0/E
-----END PGP SIGNATURE-----
Thank you for your contribution to Debian.
Added tag(s) security.
Request was from Niels Thykier <niels@thykier.net>
to control@bugs.debian.org.
(Wed, 21 Dec 2016 07:33:06 GMT) (full text, mbox, link).
Bug archived.
Request was from Debbugs Internal Request <owner@bugs.debian.org>
to internal_control@bugs.debian.org.
(Mon, 30 Jan 2017 07:33:43 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Wed Jun 19 16:41:16 2019;
Machine Name:
beach
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.
Vulmon