Published: 05/12/2017 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Tor prior to 0.2.8.12 might allow remote malicious users to cause a denial of service (client crash) via a crafted hidden service descriptor.

Vulnerable Product	Search on Vulmon	Subscribe to Product
torproject tor
opensuse project leap 42.1
debian debian linux 8.0
fedoraproject fedora 25
fedoraproject fedora 24
debian debian linux 9.0
opensuse leap 42.2
opensuse opensuse 13.2

Debian Bug report logs - #864424 tor onion services: remote assertion failure Package: tor; Maintainer for tor is Peter Palfrader <weasel@debianorg>; Source for tor is src:tor (PTS, buildd, popcon) Reported by: Peter Palfrader <weasel@debianorg> Date: Thu, 8 Jun 2017 13:21:01 UTC Severity: serious Tags: security ...

Debian Bug report logs - #848847 tor: CVE-2016-1254 (TROVE-2016-12-002): read past allocated buffer in hidden service descriptor parsing Package: tor; Maintainer for tor is Peter Palfrader <weasel@debianorg>; Source for tor is src:tor (PTS, buildd, popcon) Reported by: Peter Palfrader <weasel@debianorg> Date: Tue, ...

It was discovered that Tor, a connection-based low-latency anonymous communication system, may read one byte past a buffer when parsing hidden service descriptors This issue may enable a hostile hidden service to crash Tor clients depending on hardening options and malloc implementation For the stable distribution (jessie), this problem has been ...

CWE-119 https://www.debian.org/security/2016/dsa-3741 https://trac.torproject.org/projects/tor/ticket/21018 https://gitweb.torproject.org/tor.git/commit/?id=d978216dea6b21ac38230a59d172139185a68dbd https://blog.torproject.org/blog/tor-02812-released http://lists.opensuse.org/opensuse-updates/2016-12/msg00155.html http://lists.opensuse.org/opensuse-updates/2016-12/msg00154.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTU2R253477RZLYAJAR5DAXAON7KIVLA/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FXOJSMCTIOHLBRYFBVEL3CDLGPZXX6WE/https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=864424 https://www.debian.org/security/./dsa-3741

CVE-2016-1254

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect