Security Information / 2016 / Security Information -- DSA-3694-1 tor

Debian Security Advisory

DSA-3694-1 tor -- security update

Date Reported:

18 Oct 2016

Affected Packages:

tor

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2016-8860.

More information:

It has been discovered that Tor treats the contents of some buffer chunks as if they were a NUL-terminated string. This issue could enable a remote attacker to crash a Tor client, hidden service, relay, or authority.

For the stable distribution (jessie), this problem has been fixed in version 0.2.5.12-3.

For the unstable distribution (sid), this problem has been fixed in version 0.2.8.9-1.

For the experimental distribution, this problem has been fixed in version 0.2.9.4-alpha-1.

We recommend that you upgrade your tor packages.