CVE-2023-23589

概要

参考情報

• gitlab.torproject.org/tpo/core/tor/-/commit/a282145b3634547ab84ccd959d0537c021ff7ffc · Patch
• gitlab.torproject.org/tpo/core/tor/-/issues/40730 · Exploit
• gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.7/ReleaseNotes · Release Notes
• lists.debian.org/debian-lts-announce/2023/01/msg00026.html · Mailing List
• lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYOLTP6HQO2HPXUYKOR7P5YYYN7CINQQ
• lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZMY4FWXYKP3MDXTZ3EJ7XJVGBCKBK2XL
• security.gentoo.org/glsa/202305-11
• debian.org/security/2023/dsa-5320 · Third Party Advisory

tor のその他の脆弱性

• CVE-2026-77642緊急 9.3tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type…
• CVE-2026-77641高 8.2tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_fro…
• CVE-2026-77640中 5.3tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reac…
• CVE-2026-77639中 5.3Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under…
• CVE-2026-77638緊急 9.0Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersona…