Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:21660-1

Опубликовано: 25 авг. 2026
Источник: suse-cvrf

Описание

Security update for tor

This update for tor fixes the following issues:

Changes in tor:

  • Update to 0.4.9.11

    • Major bugfixes
      • onion services: Prevent a race condition (boo#1275918, CVE-2026-77638)
      • client: no longer assert and exit if an onion service encodes an all-zero public key for one of its introduction points
      • directory authorities: Stop allowing 0 as a port in exit policy lines
      • security, conflux: Fix a use-after-free (and potential double free) (boo#1275919, CVE-2026-77587, TROVE-2026-026)

  • Update to 0.4.9.10

    • Major bugfixes
      • conflux, security: Reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. (boo#1275920, CVE-2026-77584, TROVE-2026-025)
      • client: Resume warning about unsafe socks protocols when SafeSocks is not set. Also resume warning every time when TestSocks is set.
      • Make clients more consistently expire entry guards 48 to 60 days after they are first used.

Список пакетов

openSUSE Leap 16.0
tor-0.4.9.11-bp160.1.1

Ссылки

Описание

Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit is freed. This is TROVE-2026-025.

Затронутые продукты
openSUSE Leap 16.0:tor-0.4.9.11-bp160.1.1
Ссылки

Описание

Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026.

Затронутые продукты
openSUSE Leap 16.0:tor-0.4.9.11-bp160.1.1
Ссылки

Описание

Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach.

Затронутые продукты
openSUSE Leap 16.0:tor-0.4.9.11-bp160.1.1
Ссылки