This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2017-8820 →

DEBIAN-CVE-2017-8820

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, remote attackers...

Original description

The description as published by the source.

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, remote attackers can cause a denial of service (NULL pointer dereference and application crash) against directory authorities via a malformed descriptor, aka TROVE-2017-010.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 tor

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1.9-1"}]}]

Debian:13 tor

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1.9-1"}]}]

Debian:14 tor

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1.9-1"}]}]

References

advisory security-tracker.debian.org