Main Vulnerability Database Vulnerabilities #VU31154

Out-of-bounds read in Tor - CVE-2019-8955

Published: February 22, 2019 / Updated: July 17, 2020

Vulnerability identifier: #VU31154

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-8955

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to an out-of-bounds read that occurs via memory exhaustion in the KIST cell scheduler.

Tor
tor (Alpine package)
firefox-esr (Alpine package)
tor
Fedora
Opensuse
SUSE Linux
SUSE Package Hub for SUSE Linux Enterprise

Update to version 0.3.4.11.

Tor - update to 0.3.4.11
tor (Alpine package) - update to 0.3.3.12-r0
tor - addressed in versions 0.3.4.11-1.fc28, 0.3.5.8-1.el7, 0.3.5.8-1.fc29