openSUSE Security Update: Security update for tor
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2020:1970-1
Rating:             important
References:         #1164275 #1167013 #1167014 #1173979 #1178741 
                    
Cross-References:   CVE-2020-10592 CVE-2020-10593 CVE-2020-15572
                   
Affected Products:
                    openSUSE Leap 15.2
                    openSUSE Leap 15.1
                    openSUSE Backports SLE-15-SP2
                    openSUSE Backports SLE-15-SP1
                    SUSE Package Hub for SUSE Linux Enterprise 12
______________________________________________________________________________

   An update that solves three vulnerabilities and has two
   fixes is now available.

Description:

   This update for tor fixes the following issues:

   Updating tor to a newer version in the respective codestream.

   - tor 0.3.5.12:
     * Check channels+circuits on relays more thoroughly (TROVE-2020-005,
       boo#1178741)
     * Not affected by out-of-bound memory access (CVE-2020-15572,
       boo#1173979)
     * Fix DoS defenses on bridges with a pluggable transport
     * CVE-2020-10592: CPU consumption DoS and timing patterns (boo#1167013)
     * CVE-2020-10593: circuit padding memory leak (boo#1167014)

   - tor 0.4.4.6
     * Check channels+circuits on relays more thoroughly (TROVE-2020-005,
       boo#1178741)
     * Fix a crash due to an out-of-bound memory access (CVE-2020-15572,
       boo#1173979)
     * Fix logrotate to not fail when tor is stopped (boo#1164275)


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.2:

      zypper in -t patch openSUSE-2020-1970=1

   - openSUSE Leap 15.1:

      zypper in -t patch openSUSE-2020-1970=1

   - openSUSE Backports SLE-15-SP2:

      zypper in -t patch openSUSE-2020-1970=1

   - openSUSE Backports SLE-15-SP1:

      zypper in -t patch openSUSE-2020-1970=1

   - SUSE Package Hub for SUSE Linux Enterprise 12:

      zypper in -t patch openSUSE-2020-1970=1



Package List:

   - openSUSE Leap 15.2 (x86_64):

      tor-0.4.4.6-lp152.2.3.1
      tor-debuginfo-0.4.4.6-lp152.2.3.1
      tor-debugsource-0.4.4.6-lp152.2.3.1

   - openSUSE Leap 15.1 (x86_64):

      tor-0.3.5.12-lp151.2.6.1
      tor-debuginfo-0.3.5.12-lp151.2.6.1
      tor-debugsource-0.3.5.12-lp151.2.6.1

   - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64):

      tor-0.4.4.6-bp152.2.3.1
      tor-debuginfo-0.4.4.6-bp152.2.3.1
      tor-debugsource-0.4.4.6-bp152.2.3.1

   - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64):

      tor-0.3.5.12-bp151.3.6.1

   - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64):

      tor-0.3.5.12-25.1


References:

   https://www.suse.com/security/cve/CVE-2020-10592.html
   https://www.suse.com/security/cve/CVE-2020-10593.html
   https://www.suse.com/security/cve/CVE-2020-15572.html
   https://bugzilla.suse.com/1164275
   https://bugzilla.suse.com/1167013
   https://bugzilla.suse.com/1167014
   https://bugzilla.suse.com/1173979
   https://bugzilla.suse.com/1178741
_______________________________________________
openSUSE Security Announce mailing list -- security-announce@lists.opensuse.org
To unsubscribe, email security-announce-leave@lists.opensuse.org
List Netiquette: https://en.opensuse.org/openSUSE:Mailing_list_netiquette
List Archives: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/

openSUSE: 2020:1970-1 important: tor

November 19, 2020
An update that solves three vulnerabilities and has two fixes is now available.

Description

This update for tor fixes the following issues: Updating tor to a newer version in the respective codestream. - tor 0.3.5.12: * Check channels+circuits on relays more thoroughly (TROVE-2020-005, boo#1178741) * Not affected by out-of-bound memory access (CVE-2020-15572, boo#1173979) * Fix DoS defenses on bridges with a pluggable transport * CVE-2020-10592: CPU consumption DoS and timing patterns (boo#1167013) * CVE-2020-10593: circuit padding memory leak (boo#1167014) - tor 0.4.4.6 * Check channels+circuits on relays more thoroughly (TROVE-2020-005, boo#1178741) * Fix a crash due to an out-of-bound memory access (CVE-2020-15572, boo#1173979) * Fix logrotate to not fail when tor is stopped (boo#1164275)

 

Patch

Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1970=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1970=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1970=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1970=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-1970=1


Package List

- openSUSE Leap 15.2 (x86_64): tor-0.4.4.6-lp152.2.3.1 tor-debuginfo-0.4.4.6-lp152.2.3.1 tor-debugsource-0.4.4.6-lp152.2.3.1 - openSUSE Leap 15.1 (x86_64): tor-0.3.5.12-lp151.2.6.1 tor-debuginfo-0.3.5.12-lp151.2.6.1 tor-debugsource-0.3.5.12-lp151.2.6.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): tor-0.4.4.6-bp152.2.3.1 tor-debuginfo-0.4.4.6-bp152.2.3.1 tor-debugsource-0.4.4.6-bp152.2.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): tor-0.3.5.12-bp151.3.6.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): tor-0.3.5.12-25.1


References

https://www.suse.com/security/cve/CVE-2020-10592.html https://www.suse.com/security/cve/CVE-2020-10593.html https://www.suse.com/security/cve/CVE-2020-15572.html https://bugzilla.suse.com/1164275 https://bugzilla.suse.com/1167013 https://bugzilla.suse.com/1167014 https://bugzilla.suse.com/1173979 https://bugzilla.suse.com/1178741 openSUSE Security Announce mailing list -- security-announce@lists.opensuse.org To unsubscribe, email security-announce-leave@lists.opensuse.org List Netiquette: https://en.opensuse.org/openSUSE:Mailing_list_netiquette List Archives: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/


Severity
Announcement ID: openSUSE-SU-2020:1970-1
Rating: important
Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 SUSE Package Hub for SUSE Linux Enterprise 12 e.

Related News

5.ShakingHands Esm H320
2 - 3 min read
At The Linux Foundation's Open Source Summit North America , Linus Torvalds, the creator of Linux, discussed various topics related to Linux
30.Lock Globe Motherboard Esm H320
1 - 2 min read
The SPDX 3.0 release marks a significant milestone in software management, particularly for Linux admins, infosec professionals, internet security
11.Locks IsometricPattern Esm H320
2 - 3 min read
Open Source maintainers and developers have been warned about the continued wave of attacks aimed at project maintainers similar to those recently
28.Lock Globe Esm H320
1 - 2 min read
A resurgence of cyberattacks targeting Linux systems in Asian campaigns through the utilization of the Pupy Remote Access Trojan (RAT) has been
27.Tablet Connections Blocks Lock Esm H320
2 - 4 min read
Canonical has recently announced the Beta release of Ubuntu Linux 24.04 LTS , codenamed "Noble Numbat." This release aims to continue Ubuntu's
21.Globe RadiatingCode Esm H320
2 - 3 min read
The open-source movement has come a long way, from its origins in the 1960s and 1970s to becoming an integral part of organizations worldwide.
13.Lock StylizedMotherboard Esm H320
2 - 3 min read
The Rust-based Edera project demonstrates a unique approach to container security that addresses cloud-native computing challenges. Let's examine
8.Locks HexConnections CodeGlobe Esm H320
2 - 3 min read
Canonical has launched Ubuntu Pro for Devices , a comprehensive offering emphasizing security and compliance for IoT device deployments. This
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved