bugtraq - [SECURITY] [DSA 3694-1] tor security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 18 Oct 2016 19:07:32 +0200
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3694-1] tor security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3694-1                   security@...ian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
October 18, 2016                      https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : tor
CVE ID         : not yet available

It has been discovered that Tor treats the contents of some buffer
chunks as if they were a NUL-terminated string.  This issue could
enable a remote attacker to crash a Tor client, hidden service, relay,
or authority.

For the stable distribution (jessie), this problem has been fixed in
version 0.2.5.12-3.

For the unstable distribution (sid), this problem has been fixed in
version 0.2.8.9-1.

For the experimental distribution, this problem has been fixed in
version 0.2.9.4-alpha-1.

We recommend that you upgrade your tor packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCAAGBQJYBlZPAAoJEBDCk7bDfE42c6cQAL2lEK9G1cglX36kzYbpGdJj
WKneS0/4Yv3gYoIkq3x2eWg9oqhG8O6d849X8Y4TqpUp+DIB1NC1h2B1Ia4wYC8q
HxpmLM0alrNZImfKPHMq3yOFkELa3OyvFREshTixBJDtvvM5G4/ek16UVqDQK9jQ
cwTTSb4TwJySiWekD0naWBRzmJt3XJ8+j6uGYRMD8mSgjtlDAX8jtI+puXRfKS/m
YNnzJC3Aa7UjWIUgroC6C5yOchflsCyfpJXJo0jpvhke8d0h3wMMOLXO5h87MZAV
xBRryhAZizaU9leHyQh8XCO6U/1UFg1Jm9Ruc8k/yz69+FHV6Ck1ImhlLQfjpoUt
FtkAm+oDiQss+ndEI4p+AmmYwoBsOrp5uy8vJaxYhNppAY6EQNrQfl9hDsHJ0O86
0b7qKe3eMa9Bfn+FejbSFc0SzqOkdd+DVbgXHaf+emEkMxxKOA8BDg+mf77WJVIJ
bU6lLevZV59yorn4pOpK+qJs0etkCN5pDcuCvI7/xGtqxOLcR/0miOXdJ+Mj874b
xM8vf4bVjJYxhwUH2vOu4kWvsBPg095Hjb/Gr/wDOuq+w/Cl/nMyXt74wDYf85pQ
NGzFHxxLpHsX5FDM3AvRJ6OgHW/vNcOgMP1zYGOXGAMzuacVbZnvwQsIOD8DxnhU
0DPrg39QsmuRrlGCYrU0
=dpuy
-----END PGP SIGNATURE-----