CVE-2017-8820 — NULL Pointer Dereference in Project TOR

CWE-476 — NULL Pointer Dereference7 documents6 sources
Severity
7.5HIGHNVD
EPSS
0.4%
top 36.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Torproject TORTOR Project TORDebian Linux
Timeline
PublishedDec 3
Latest updateMay 17

Description

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, remote attackers can cause a denial of service (NULL pointer dereference and application crash) against directory authorities via a malformed descriptor, aka TROVE-2017-010.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDtor_project/tor0.2.6 — 0.2.8.17+4
▶Debiantorproject/tor< 0.3.1.9-1+3

Also affects: Debian Linux 8.0, 9.0

🔴Vulnerability Details

3
GHSA
GHSA-rcr7-p7pf-h84m: In Tor before 0↗2022-05-17
▶
CVEList
CVE-2017-8820: In Tor before 0↗2017-12-03
▶
OSV
CVE-2017-8820: In Tor before 0↗2017-12-03
▶

📋Vendor Advisories

1
Debian
CVE-2017-8820: tor - In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9....↗2017
▶

💬Community

2
Bugzilla
CVE-2017-8819 CVE-2017-8820 CVE-2017-8821 CVE-2017-8822 CVE-2017-8823 tor: Multiple vulnerabilities [epel-6]↗2017-12-05
▶
Bugzilla
CVE-2017-8820 CVE-2017-8821 CVE-2017-8822 CVE-2017-8819 CVE-2017-8823 tor: Multiple vulnerabilities↗2017-12-05
▶
CVE-2017-8820 — NULL Pointer Dereference in Project TOR | cvebase