oss-security - CVE request: Two vulnerabilities in Tor

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150323181327.GA3943@pisco.westfalen.local>
Date: Mon, 23 Mar 2015 19:13:27 +0100
From: Moritz Muehlenhoff <jmm@...ian.org>
To: cve-assign@...re.org
Cc: oss-security@...ts.openwall.com, weasel@...ian.org
Subject: CVE request: Two vulnerabilities in Tor

Hi,
please assign two CVE IDs for tor:

The upstream announcement is here:
https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html

1.
| Fix a remote denial-of-service opportunity caused by a bug in
| OSX's _strlcat_chk() function. Fixes bug 15205; bug first
| appeared in OSX 10.9.

https://trac.torproject.org/projects/tor/ticket/15205

2.
| A relay could crash with an assertion error if a buffer of
| exactly the wrong layout was passed to buf_pullup() at exactly the
| wrong  time.

https://trac.torproject.org/projects/tor/ticket/15083

The second issue has been addressed in DSA 3203:
https://lists.debian.org/debian-security-announce/2015/msg00088.html
(the first obviously not, since it's MacOS-specific)

Cheers,
        Moritz

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.