CVE-2012-3518

Description

The networkstatus_parse_vote_from_string function in routerparse.c in Tor before 0.2.2.38 does not properly handle an invalid flavor name, which allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted (1) vote document or (2) consensus document.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
tor	17.04 zesty	Fixed 0.2.3.22-rc-1
	16.10 yakkety	Fixed 0.2.3.22-rc-1
	16.04 LTS xenial	Fixed 0.2.3.22-rc-1
	15.10 wily	Fixed 0.2.3.22-rc-1
	15.04 vivid	Fixed 0.2.3.22-rc-1
	14.10 utopic	Fixed 0.2.3.22-rc-1
	14.04 LTS trusty	Fixed 0.2.3.22-rc-1
	13.10 saucy	Fixed 0.2.3.22-rc-1
	13.04 raring	Fixed 0.2.3.22-rc-1
	12.10 quantal	Fixed 0.2.3.22-rc-1
	12.04 LTS precise	Ignored end of life
	11.10 oneiric	Ignored end of life
	11.04 natty	Ignored end of life
	10.04 LTS lucid	Not in release
	8.04 LTS hardy	Ignored end of life

Notes

sbeattie

may have been introduced in 0.2.2.6-alpha

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
tor	Upstream: https://gitweb.torproject.org/tor.git/commitdiff/57e35ad3d91724882c345ac709666a551a977f0f Upstream: https://gitweb.torproject.org/tor.git/commitdiff/55f635745afacefffdaafc72cc176ca7ab817546

Description

Status

Notes

sbeattie

Patch details

References

Other references