CVE-2020-15572
Fixed in a distro release EPSS 1%
Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001.
Products: torproject tor
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | tor | 0.4.3.6-1 |
| Debian 13 | tor | 0.4.3.6-1 |
| Debian 14 | tor | 0.4.3.6-1 |
| SUSE Package Hub 12 | tor | 0.4.4.6-bp152.2.3.1 |
| SUSE Package Hub 15 SP1 | tor | 0.4.4.6-bp152.2.3.1 |
| SUSE Package Hub 15 SP2 | tor | 0.4.4.6-bp152.2.3.1 |
| openSUSE Leap 15.1 | tor | 0.4.4.6-bp152.2.3.1 |
| openSUSE Leap 15.2 | tor | 0.4.4.6-bp152.2.3.1 |
| openSUSE Tumbleweed | tor | 0.4.6.7-2.2 |