SB2015041008 - Fedora EPEL 7 update for tor
Published: April 10, 2015 Updated: April 24, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Improper Handling of Exceptional Conditions (CVE-ID: CVE-2015-2688)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.
2) Input validation error (CVE-ID: CVE-2015-2689)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.
3) Input validation error (CVE-ID: CVE-2015-2928)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The Hidden Service (HS) server implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors.
4) Input validation error (CVE-ID: CVE-2015-2929)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and application exit) via a malformed HS descriptor.
Remediation
Install update from vendor's website.