CVE-2020-15572

NameCVE-2020-15572
DescriptionTor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
tor (PTS)stretch0.2.9.16-1vulnerable
stretch (security)0.2.9.15-1vulnerable
buster, buster (security)0.3.5.10-1vulnerable
bullseye, sid0.4.4.5-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
torsource(unstable)0.4.3.6-1unimportant

Notes

Tor in Debian doesn't use NSS
https://blog.torproject.org/new-release-tor-03511-0428-0436-security-fixes

Search for package or bug name: Reporting problems