Denial of Service Vulnerability in Tor Software by The Tor Project
CVE-2015-2688

7.5HIGH

Key Information:

Vendor

The Tor Project

Status
Tor
Vendor
CVE Published:
24 January 2020

What is CVE-2015-2688?

The vulnerability in the Tor software arises from the buf_pullup function’s inability to properly handle the arrival of buffers with unexpected and invalid layouts. This flaw allows remote attackers to send specially crafted packets, leading to an assertion failure and causing the Tor daemon to exit unexpectedly. This results in a denial of service, interrupting normal operations and potentially impacting users relying on the anonymity that Tor offers.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Tor before 0.2.4.26

Tor 0.2.5.x before 0.2.5.11

References

https://lists.torproject.org/pipermail/tor-talk/2015-Marc...
x_refsource_MISC
https://trac.torproject.org/projects/tor/ticket/15083
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.