| Summary: | tor new versions 0.2.4.27 and 0.2.5.12 fix security issues (CVE-2015-292[89]) | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | jani.valimaa, oe, olchal, sysadmin-bugs |
| Version: | 4 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/639390/ | ||
| Whiteboard: | has_procedure advisory MGA4-64-OK MGA4-32-OK | ||
| Source RPM: | tor-0.2.4.26-1.mga4.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2015-04-06 23:48:34 CEST
David Walser
2015-04-06 23:49:10 CEST
CC:
(none) =>
jani.valimaa 0.2.4.27 is there and 0.2.5.12 needs to be submitted. CC:
(none) =>
oe Debian has issued an advisory for this on April 6: https://lists.debian.org/debian-security-announce/2015/msg00103.html The DSA will be posted here: https://www.debian.org/security/2015/dsa-3216 URL:
(none) =>
http://lwn.net/Vulnerabilities/639390/ Testing Procedure: https://bugs.mageia.org/show_bug.cgi?id=3953#c4 Advisory: ======================== "disgleirio" discovered that a malicious client could trigger an assertion failure in a Tor instance providing a hidden service, thus rendering the service inaccessible (CVE-2015-2928). "DonnchaC" discovered that Tor clients would crash with an assertion failure upon parsing specially crafted hidden service descriptors (CVE-2015-2929). Introduction points would accept multiple INTRODUCE1 cells on one circuit, making it inexpensive for an attacker to overload a hidden service with introductions. Introduction points now no longer allow multiple cells of that type on the same circuit. The tor package has been updated to version 0.2.4.27, fixing these issues. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2928 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2929 https://blog.torproject.org/blog/tor-02512-and-0267-are-released https://www.debian.org/security/2015/dsa-3216 ======================== Updated packages in core/updates_testing: ======================== tor-0.2.4.27-1.mga4 from tor-0.2.4.27-1.mga4.src.rpm Version:
Cauldron =>
4 Testing on Mageia4x64 real hardware Using privoxy-3.0.21-2.3.mga4 From current package : -------------------- tor-0.2.4.26-1.mga4 Previously installed and tested in previous bug (https://bugs.mageia.org/show_bug.cgi?id=15518#c4) To updated testing package : -------------------------- tor-0.2.4.27-1.mga4.x86_64 $ tor Apr 10 00:00:14.262 [notice] Tor v0.2.4.27 (git-85169a121e3b59d2) running on Linux with Libevent 2.0.21-stable and OpenSSL 1.0.1m. (...) Apr 10 00:01:19.000 [notice] Bootstrapped 100%: Done. Browsed to : https://check.torproject.org/ Congratulations. This browser is configured to use Tor. OK here CC:
(none) =>
olchal Testing on Mageia4x32 real hardware Same procedure $ tor Apr 10 00:07:03.714 [notice] Tor v0.2.4.27 (git-85169a121e3b59d2) running (...) Apr 10 00:07:18.000 [notice] Bootstrapped 100%: Done. https://check.torproject.org/ Congratulations. This browser is configured to use Tor. OK for Mageai4x32 Whiteboard:
has_procedure MGA4-64-OK =>
has_procedure MGA4-64-OK MGA4-32-OK Validating. Advisory uploaded. Please push to 4 updates Thanks Keywords:
(none) =>
validated_update An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2015-0151.html Status:
NEW =>
RESOLVED |