diff options
| author | rene <rene@FreeBSD.org> | 2016-10-19 01:26:07 +0800 |
|---|---|---|
| committer | rene <rene@FreeBSD.org> | 2016-10-19 01:26:07 +0800 |
| commit | c978f33f460b3823f8db21d8e69c34edb118789f (patch) | |
| tree | 8284d49d4476af286b4da009892024403b81bcfd | |
| parent | deb6bbe68d43e9a587cc8ea6aa39d13159cf04c1 (diff) | |
| download | freebsd-ports-gnome-c978f33f460b3823f8db21d8e69c34edb118789f.tar.gz freebsd-ports-gnome-c978f33f460b3823f8db21d8e69c34edb118789f.tar.zst freebsd-ports-gnome-c978f33f460b3823f8db21d8e69c34edb118789f.zip | |
Document remote denial of service vulnerability in security/tor*
PR: 212952
Submitted by: Neel Chauhan <neel@neelc.org>
Obtained from: https://blog.torproject.org/blog/tor-0289-released-important-fixes
| -rw-r--r-- | security/vuxml/vuln.xml | 36 |
1 files changed, 36 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 4b66daa4f1df..9d1be143f463 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,42 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="c1dc55dc-9556-11e6-b154-3065ec8fd3ec"> + <topic>Tor -- remote denial of service</topic> + <affects> + <package> + <name>tor</name> + <range><lt>0.2.8.9</lt></range> + </package> + <package> + <name>tor-devel</name> + <range><lt>0.2.9.4-alpha</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>The Tor Blog reports:</p> + <blockquote cite="https://blog.torproject.org/blog/tor-0289-released-important-fixes"> + <p>Prevent a class of security bugs caused by treating the contents + of a buffer chunk as if they were a NUL-terminated string. At least + one such bug seems to be present in all currently used versions of + Tor, and would allow an attacker to remotely crash most Tor + instances, especially those compiled with extra compiler hardening. + With this defense in place, such bugs can't crash Tor, though we + should still fix them as they occur. Closes ticket 20384 + (TROVE-2016-10-001).</p> + </blockquote> + </body> + </description> + <references> + <url>https://blog.torproject.org/blog/tor-0289-released-important-fixes</url> + </references> + <dates> + <discovery>2016-10-17</discovery> + <entry>2016-10-18</entry> + </dates> + </vuln> + <vuln vid="43f1c867-654a-11e6-8286-00248c0c745d"> <topic>Rails 4 -- Possible XSS Vulnerability in Action View</topic> <affects> |