CVE-2020-15572

Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 65%
VendorProductVersion
torprojecttor
𝑥
< 0.3.5.11
torprojecttor
0.4.2.0 <
𝑥
< 0.4.2.8
torprojecttor
0.4.3.0 <
𝑥
< 0.4.3.6
torprojecttor
0.4.4.0:alpha
torprojecttor
0.4.4.1:alpha
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
tor
bullseye (security)
0.4.5.16-1
fixed
bullseye
0.4.5.16-1
fixed
bookworm
0.4.7.16-1
fixed
bookworm (security)
0.4.7.16-1
fixed
sid
0.4.8.13-2
fixed
trixie
0.4.8.13-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
tor
focal
not-affected
eoan
not-affected
bionic
not-affected
xenial
not-affected
trusty
not-affected
Common Weakness Enumeration
References
https://blog.torproject.org/new-release-tor-03511-0428-0436-security-fixes
https://gitlab.torproject.org/tpo/core/tor/-/issues/33119
https://trac.torproject.org/projects/tor/wiki/TROVE
https://blog.torproject.org/new-release-tor-03511-0428-0436-security-fixes
https://gitlab.torproject.org/tpo/core/tor/-/issues/33119
https://trac.torproject.org/projects/tor/wiki/TROVE