Torproject » TOR : Security Vulnerabilities

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2023-23589			2023-01-14	2023-05-03	0.0	None	???	???	???	???	???	???
The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022-002.
2	CVE-2022-33903		DoS	2022-07-17	2023-05-03	0.0	None	???	???	???	???	???	???
Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation.
3	CVE-2021-38385	617		2021-08-30	2023-05-03	5.0	None	Remote	Low	Not required	None	None	Partial
Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007.
4	CVE-2021-34550	119	Overflow	2021-06-29	2021-09-20	5.0	None	Remote	Low	Not required	None	None	Partial
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006. The v3 onion service descriptor parsing allows out-of-bounds memory access, and a client crash, via a crafted onion service descriptor
5	CVE-2021-34549	400		2021-06-29	2022-07-12	5.0	None	Remote	Low	Not required	None	None	Partial
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can trigger the use of an attacker-chosen circuit ID to cause algorithm inefficiency.
6	CVE-2021-34548	863	Bypass	2021-06-29	2021-09-14	5.0	None	Remote	Low	Not required	None	None	Partial
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream.
7	CVE-2021-28090			2021-03-19	2022-05-16	5.0	None	Remote	Low	Not required	None	None	Partial
Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.
8	CVE-2021-28089	400		2021-03-19	2022-05-16	5.0	None	Remote	Low	Not required	None	None	Partial
Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001.
9	CVE-2020-15572	119	Overflow	2020-07-15	2021-07-21	4.3	None	Remote	Medium	Not required	None	None	Partial
Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001.
10	CVE-2020-10593	401	DoS	2020-03-23	2023-02-03	5.0	None	Remote	Low	Not required	None	None	Partial
Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), aka TROVE-2020-004. This occurs in circpad_setup_machine_on_circ because a circuit-padding machine can be negotiated twice on the same circuit.
11	CVE-2020-10592		DoS	2020-03-23	2022-01-01	7.8	None	Remote	Low	Not required	None	None	Complete
Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TROVE-2020-002.
12	CVE-2020-8516			2020-02-02	2022-04-18	5.0	None	Remote	Low	Not required	Partial	None	None
DISPUTED The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, which might make it easier for remote attackers to discover circuit information. NOTE: The network team of Tor claims this is an intended behavior and not a vulnerability.
13	CVE-2019-8955	770	DoS	2019-02-21	2020-08-24	5.0	None	Remote	Low	Not required	None	None	Partial
In Tor before 0.3.3.12, 0.3.4.x before 0.3.4.11, 0.3.5.x before 0.3.5.8, and 0.4.x before 0.4.0.2-alpha, remote denial of service against Tor clients and relays can occur via memory exhaustion in the KIST cell scheduler.
14	CVE-2018-0491	416	DoS	2018-03-05	2019-03-26	5.0	None	Remote	Low	Not required	None	None	Partial
A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to cause a denial of service (relay crash) because the KIST implementation allows a channel to be added more than once in the pending list.
15	CVE-2018-0490	476	DoS	2018-03-05	2019-04-30	5.0	None	Remote	Low	Not required	None	None	Partial
An issue was discovered in Tor before 0.2.9.15, 0.3.1.x before 0.3.1.10, and 0.3.2.x before 0.3.2.10. The directory-authority protocol-list subprotocol implementation allows remote attackers to cause a denial of service (NULL pointer dereference and directory-authority crash) via a misformatted relay descriptor that is mishandled during voting.
16	CVE-2017-0380	532	+Info	2017-09-18	2017-11-06	4.3	None	Remote	Medium	Not required	Partial	None	None
The rend_service_intro_established function in or/rendservice.c in Tor before 0.2.8.15, 0.2.9.x before 0.2.9.12, 0.3.0.x before 0.3.0.11, 0.3.1.x before 0.3.1.7, and 0.3.2.x before 0.3.2.1-alpha, when SafeLogging is disabled, allows attackers to obtain sensitive information by leveraging access to the log files of a hidden service, because uninitialized stack data is included in an error message about construction of an introduction point circuit.
17	CVE-2017-0377	200	+Info	2017-07-02	2017-07-14	5.0	None	Remote	Low	Not required	Partial	None	None
Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.
18	CVE-2017-0376	617	DoS	2017-06-09	2019-10-03	5.0	None	Remote	Low	Not required	None	None	Partial
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.
19	CVE-2017-0375	617	DoS	2017-06-09	2019-10-03	5.0	None	Remote	Low	Not required	None	None	Partial
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the relay_send_end_cell_from_edge_ function via a malformed BEGIN cell.
20	CVE-2016-8860	119	DoS Overflow	2017-01-04	2017-07-01	5.0	None	Remote	Low	Not required	None	None	Partial
Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data had NUL termination, but the implementation of or/buffers.c did not ensure that NUL termination was present, which allows remote attackers to cause a denial of service (client, hidden service, relay, or authority crash) via crafted data.
21	CVE-2016-1254	119	DoS Overflow	2017-12-05	2018-10-30	5.0	None	Remote	Low	Not required	None	None	Partial
Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor.
22	CVE-2015-2929		DoS	2020-01-24	2020-02-01	5.0	None	Remote	Low	Not required	None	None	Partial
The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and application exit) via a malformed HS descriptor.
23	CVE-2015-2928		DoS	2020-01-24	2020-02-01	5.0	None	Remote	Low	Not required	None	None	Partial
The Hidden Service (HS) server implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors.
24	CVE-2015-2689	20	DoS	2020-01-24	2020-01-31	5.0	None	Remote	Low	Not required	None	None	Partial
Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.
25	CVE-2015-2688	755	DoS	2020-01-24	2020-01-31	5.0	None	Remote	Low	Not required	None	None	Partial
buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.
26	CVE-2014-5117			2014-07-30	2017-01-07	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAY_EARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAY_EARLY cells as a means of communicating information about hidden service names.
27	CVE-2013-7295	310	Bypass	2014-01-17	2014-02-12	4.0	None	Remote	High	Not required	Partial	Partial	None
Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors.
28	CVE-2012-5573	399	DoS Bypass	2013-01-01	2017-08-29	5.0	None	Remote	Low	Not required	None	None	Partial
The connection_edge_process_relay_cell function in or/relay.c in Tor before 0.2.3.25 maintains circuits even if an unexpected SENDME cell arrives, which might allow remote attackers to cause a denial of service (memory consumption or excessive cell reception rate) or bypass intended flow-control restrictions via a RELAY_COMMAND_SENDME command.
29	CVE-2012-4922	20	DoS	2012-09-14	2013-08-22	5.0	None	Remote	Low	Not required	None	None	Partial
The tor_timegm function in common/util.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.22-rc, does not properly validate time values, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed directory object, a different vulnerability than CVE-2012-4419.
30	CVE-2012-4419		DoS	2012-09-14	2013-08-22	5.0	None	Remote	Low	Not required	None	None	Partial
The compare_tor_addr_to_addr_policy function in or/policies.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.21-rc, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a zero-valued port field that is not properly handled during policy comparison.
31	CVE-2012-2250		DoS	2014-02-03	2014-02-21	5.0	None	Remote	Low	Not required	None	None	Partial
Tor before 0.2.3.24-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) by performing link protocol negotiation incorrectly.
32	CVE-2012-2249		DoS	2014-02-03	2014-02-21	5.0	None	Remote	Low	Not required	None	None	Partial
Tor before 0.2.3.23-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a renegotiation attempt that occurs after the initiation of the V3 link protocol.

Total number of vulnerabilities : 32 Page : 1 (This Page)