CVE-2010-1676 — Improper Restriction of Operations within the Bounds of a Memory Buffer in TOR

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer8 documents6 sources
Severity
10.0CRITICALNVD
EPSS
12.4%
top 6.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Torproject TORTOR
Timeline
PublishedDec 22
Latest updateMay 17

Description

Heap-based buffer overflow in Tor before 0.2.1.28 and 0.2.2.x before 0.2.2.20-alpha allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via unspecified vectors.

CVSS vector

AV:N/AC:L/C:C/I:C/A:CExploitability: 10.0 | Impact: 10.0

Affected Packages2 packages

▶Debiantorproject/tor< 0.2.1.26-6+3
▶NVDtor/tor0.2.1.1.27+143

Patches

Patch: archives.seul.org ↗Patch: blog.torproject.org ↗Patch: blog.torproject.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-pqjq-7p8q-hp58: Heap-based buffer overflow in Tor before 0↗2022-05-17
▶
CVEList
CVE-2010-1676: Heap-based buffer overflow in Tor before 0↗2010-12-22
▶
OSV
CVE-2010-1676: Heap-based buffer overflow in Tor before 0↗2010-12-22
▶

📋Vendor Advisories

1
Debian
CVE-2010-1676: tor - Heap-based buffer overflow in Tor before 0.2.1.28 and 0.2.2.x before 0.2.2.20-al...↗2010
▶

💬Community

3
Bugzilla
CVE-2011-0015 CVE-2011-0016 CVE-2011-0427 CVE-2011-0490 CVE-2011-0491 CVE-2011-0492 CVE-2011-0493 CVE-2010-1676 CVE-2010-0383 CVE-2010-0385 tor various flaws [epel-5]↗2011-01-20
▶
Bugzilla
CVE-2010-1676 Tor: Remotely exploitable heap-based buffer overflow↗2010-12-22
▶
Bugzilla
CVE-2010-1159 aircrack-ng: remote denial of service↗2010-04-14
▶
CVE-2010-1676 — TOR vulnerability | cvebase