Bug 603174 – <net-misc/tor-0.2.8.12: Remote DoS via parsing problem

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2016-12-20 11:06:02 UTC]

From ${URL} :

It was found that there is an issue with parsing that could ause clients to read a single byte past the end of an allocated region. This bug could be 
used to cause hardened clients (built with --enable-expensive-hardening) to crash if they tried to visit a hostile hidden service. Non-hardened clients 
are only affected depending on the details of their platform's memory allocator.

External References:

https://lists.torproject.org/pipermail/tor-announce/2016-December/000122.html

Upstream patch:

https://gitweb.torproject.org/tor.git/commit/?id=d978216dea6b21ac38230a59d172139185a68dbd


@maintainer(s): since the fixed package is already in the tree, please let us know if it is ready for the stabilization or not.

[Comment 1 Anthony Basile 2017-01-01 22:31:24 UTC]

Okay, let's stabilize =net-misc/tor-0.2.8.12

KEYWORDS="amd64 arm ppc ppc64 sparc x86"

[Comment 2 Agostino Sarubbo 2017-01-01 22:40:14 UTC]

amd64 stable

[Comment 3 Agostino Sarubbo 2017-01-04 17:11:59 UTC]

x86 stable

[Comment 4 Markus Meier 2017-01-08 18:34:52 UTC]

arm stable

[Comment 5 Agostino Sarubbo 2017-01-11 10:52:51 UTC]

sparc stable

[Comment 6 Agostino Sarubbo 2017-01-15 16:04:55 UTC]

ppc stable

[Comment 7 Jeroen Roovers (RETIRED) 2017-01-16 15:39:34 UTC]

Stable for PPC64.

[Comment 8 Thomas Deutschmann (RETIRED) 2017-01-30 01:38:44 UTC]

GLSA Vote: No

Repository is clean.