[manjaro-security] [ASA-201712-10] tor: multiple issues
rgacogne at archlinux.org
Sat Dec 16 20:20:36 CET 2017
Arch Linux Security Advisory ASA-201712-10
Date : 2017-12-16
CVE-ID : CVE-2017-8819 CVE-2017-8820 CVE-2017-8822 CVE-2017-8823
Package : tor
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-539
The package tor before version 0.3.1.9-1 is vulnerable to multiple
issues including arbitrary code execution, information disclosure and
denial of service.
Upgrade to 0.3.1.9-1.
# pacman -Syu "tor>=0.3.1.9-1"
The problems have been fixed upstream in version 0.3.1.9.
- CVE-2017-8819 (information disclosure)
An issue has been found in the way Tor before 0.3.1.9 checked for
replays, leading to a possible traffic confirmation attack.
- CVE-2017-8820 (denial of service)
A denial of service issue where an attacker could crash a directory
authority using a malformed router descriptor has been found in Tor
- CVE-2017-8822 (information disclosure)
In Tor before 0.3.1.9, relays (that have incompletely downloaded
descriptors) can pick themselves in a circuit path, leading to a
degradation of anonymity, aka TROVE-2017-012.
- CVE-2017-8823 (arbitrary code execution)
A use-after-free vulnerability has been found in Tor before 0.3.1.9,
leading to a crash of v2 Tor onion services when they failed to open
circuits while expiring introduction points.
A remote attacker might be able to reduce the anonymity of Tor users,
cause a denial of service or execute arbitrary code on the affected
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: OpenPGP digital signature
More information about the manjaro-security