There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in Tor before 0.2.9.15, 0.3.1.x before 0.3.1.10, and 0.3.2.x before 0.3.2.10. The
    directory-authority protocol-list subprotocol implementation allows remote attackers to cause a denial of
    service (NULL pointer dereference and directory-authority crash) via a misformatted relay descriptor that
    is mishandled during voting. (CVE-2018-0490)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Tor before 0.2.9.15, 0.3.1.x before 0.3.1.10, and 0.3.2.x before 0.3.2.10. The
    directory-authority protocol-list subprotocol implementation allows remote attackers to cause a denial of
    service (NULL pointer dereference and directory-authority crash) via a misformatted relay descriptor that
    is mishandled during voting. (CVE-2018-0490)

  - A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to cause
    a denial of service (relay crash) because the KIST implementation allows a channel to be added more than
    once in the pending list. (CVE-2018-0491)

發現連線型低延遲匿名通訊系統 Tor 含有通訊協定清單處理錯誤，攻擊者可在遠端利用此錯誤，以 NULL 指標例外狀況來損毀目錄授權單位 (TROVE-2018-001)。

已发现基于连接的低延迟匿名通信系统 Tor 包含一个协议列表处理错误，可用于通过空指针异常 (TROVE-2018-001) 远程导致目录授权崩溃。

このtorのバージョン0.3.2.10への更新では、セキュリティ問題とバグが修正されます。

次の脆弱性が修正されました：

  - CVE-2018-0490：ディレクトリ権限に対するリモートクラッシュの脆弱性（boo#1083845、TROVE-2018-001）

  - CVE-2018-0491：リモートリレークラッシュ（boo#1083846、TROVE-2018-002）

この新しいUpstreamの安定版には、リレーに対するDoS攻撃とその他のさまざまなバグ修正への耐性が強化された新しいシステムも含まれています。

接続ベースの低遅延匿名通信システムであるTorに、NULLポインターの例外でディレクトリ権限をリモートでクラッシュさせるのに利用される可能性がある、プロトコルリスト処理のバグが含まれていることが判明しました（TROVE-2018-001）。

It has been discovered that Tor, a connection-based low-latency anonymous communication system, contains a protocol-list handling bug that could be used to remotely crash directory authorities with a NULL pointer exception (TROVE-2018-001).

This update for tor to version 0.3.2.10 fixes security issues and bugs.

The following vulnerabilities were fixed :

  - CVE-2018-0490: remote crash vulnerability against     directory authorities (boo#1083845, TROVE-2018-001)

  - CVE-2018-0491: remote relay crash (boo#1083846,     TROVE-2018-002)

This new upstream stable version also contains a new system for improved resistance to DoS attacks against relays and various other bug fixes.

ID	Name	Product	Family	Published	Updated	Severity
407396	Alpine: multiple tor packages: security update to 0.3.1.10-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	10/31/2023	7/2/2026	high
407397	Alpine: multiple tor packages: security update to 0.3.2.10-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	10/31/2023	7/2/2026	high
407396	Alpine: multiple tor packages: security update to 0.3.1.10-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	10/31/2023	7/2/2026	high
407397	Alpine: multiple tor packages: security update to 0.3.2.10-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	10/31/2023	7/2/2026	high
109412	Debian DSA-4183-1：tor - 安全性更新	Nessus	Debian Local Security Checks	4/30/2018	10/16/2024	high
109412	Debian DSA-4183-1：tor - 安全更新	Nessus	Debian Local Security Checks	4/30/2018	10/16/2024	high
107179	openSUSEセキュリティ更新プログラム：tor（openSUSE-2018-223）	Nessus	SuSE Local Security Checks	3/7/2018	10/27/2025	high
109412	Debian DSA-4183-1：tor - セキュリティ更新	Nessus	Debian Local Security Checks	4/30/2018	10/16/2024	high
109412	Debian DSA-4183-1 : tor - security update	Nessus	Debian Local Security Checks	4/30/2018	10/16/2024	high
107179	openSUSE Security Update : tor (openSUSE-2018-223)	Nessus	SuSE Local Security Checks	3/7/2018	10/27/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high