rpm package
opensuse/tor&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/tor&distro=openSUSE%20Tumbleweed
Vulnerabilities (57)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-87724 | Med | 6.5 | < 0.4.9.13-1.1 | 0.4.9.13-1.1 | Sep 9, 2026 | Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032. | |
| CVE-2026-77638 | Hig | 8.9 | < 0.4.9.11-1.1 | 0.4.9.11-1.1 | Aug 20, 2026 | Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach. | |
| CVE-2026-77587 | Med | 5.9 | < 0.4.9.11-1.1 | 0.4.9.11-1.1 | Aug 20, 2026 | Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026. | |
| CVE-2026-77584 | Hig | 7.0 | < 0.4.9.11-1.1 | 0.4.9.11-1.1 | Aug 20, 2026 | Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a | |
| CVE-2026-44603 | Low | 3.7 | < 0.4.9.8-1.1 | 0.4.9.8-1.1 | May 7, 2026 | Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007. | |
| CVE-2026-44602 | Low | 3.7 | < 0.4.9.8-1.1 | 0.4.9.8-1.1 | May 7, 2026 | Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006. | |
| CVE-2026-44601 | Low | 3.7 | < 0.4.9.8-1.1 | 0.4.9.8-1.1 | May 7, 2026 | Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit, aka TROVE-2026-009. | |
| CVE-2026-44600 | Low | 3.7 | < 0.4.9.8-1.1 | 0.4.9.8-1.1 | May 7, 2026 | Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-2026-010. | |
| CVE-2026-44599 | Low | 3.7 | < 0.4.9.8-1.1 | 0.4.9.8-1.1 | May 7, 2026 | Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008. | |
| CVE-2026-44597 | Low | 3.7 | < 0.4.9.8-1.1 | 0.4.9.8-1.1 | May 7, 2026 | Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011. | |
| CVE-2025-4444 | Low | 3.7 | < 0.4.8.18-1.1 | 0.4.8.18-1.1 | Sep 18, 2025 | A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated a | |
| CVE-2022-33903 | Hig | 7.5 | < 0.4.7.8-1.1 | 0.4.7.8-1.1 | Jul 17, 2022 | Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation. | |
| CVE-2021-22929 | Med | 6.1 | < 0.4.6.8-1.1 | 0.4.6.8-1.1 | Aug 31, 2021 | An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2 onion domains in tor.log. | |
| CVE-2021-38385 | Hig | 7.5 | < 0.4.6.7-2.2 | 0.4.6.7-2.2 | Aug 30, 2021 | Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007. | |
| CVE-2021-34550 | Hig | 7.5 | < 0.4.6.7-2.2 | 0.4.6.7-2.2 | Jun 29, 2021 | An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006. The v3 onion service descriptor parsing allows out-of-bounds memory access, and a client crash, via a crafted onion service descriptor | |
| CVE-2021-34549 | Hig | 7.5 | < 0.4.6.7-2.2 | 0.4.6.7-2.2 | Jun 29, 2021 | An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can trigger the use of an attacker-chosen circuit ID to cause algorithm inefficiency. | |
| CVE-2021-34548 | Hig | 7.5 | < 0.4.6.7-2.2 | 0.4.6.7-2.2 | Jun 29, 2021 | An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream. | |
| CVE-2021-28090 | Med | 5.3 | < 0.4.6.7-2.2 | 0.4.6.7-2.2 | Mar 19, 2021 | Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002. | |
| CVE-2021-28089 | Hig | 7.5 | < 0.4.6.7-2.2 | 0.4.6.7-2.2 | Mar 19, 2021 | Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001. | |
| CVE-2020-15572 | Hig | 7.5 | < 0.4.6.7-2.2 | 0.4.6.7-2.2 | Jul 15, 2020 | Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001. |
- affected < 0.4.9.13-1.1fixed 0.4.9.13-1.1
Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032.
- affected < 0.4.9.11-1.1fixed 0.4.9.11-1.1
Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach.
- affected < 0.4.9.11-1.1fixed 0.4.9.11-1.1
Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026.
- affected < 0.4.9.11-1.1fixed 0.4.9.11-1.1
Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a
- affected < 0.4.9.8-1.1fixed 0.4.9.8-1.1
Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007.
- affected < 0.4.9.8-1.1fixed 0.4.9.8-1.1
Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006.
- affected < 0.4.9.8-1.1fixed 0.4.9.8-1.1
Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit, aka TROVE-2026-009.
- affected < 0.4.9.8-1.1fixed 0.4.9.8-1.1
Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-2026-010.
- affected < 0.4.9.8-1.1fixed 0.4.9.8-1.1
Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.
- affected < 0.4.9.8-1.1fixed 0.4.9.8-1.1
Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011.
- affected < 0.4.8.18-1.1fixed 0.4.8.18-1.1
A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated a
- affected < 0.4.7.8-1.1fixed 0.4.7.8-1.1
Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation.
- affected < 0.4.6.8-1.1fixed 0.4.6.8-1.1
An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2 onion domains in tor.log.
- affected < 0.4.6.7-2.2fixed 0.4.6.7-2.2
Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007.
- affected < 0.4.6.7-2.2fixed 0.4.6.7-2.2
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006. The v3 onion service descriptor parsing allows out-of-bounds memory access, and a client crash, via a crafted onion service descriptor
- affected < 0.4.6.7-2.2fixed 0.4.6.7-2.2
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can trigger the use of an attacker-chosen circuit ID to cause algorithm inefficiency.
- affected < 0.4.6.7-2.2fixed 0.4.6.7-2.2
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream.
- affected < 0.4.6.7-2.2fixed 0.4.6.7-2.2
Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.
- affected < 0.4.6.7-2.2fixed 0.4.6.7-2.2
Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001.
- affected < 0.4.6.7-2.2fixed 0.4.6.7-2.2
Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001.
Page 1 of 3