CVE-2020-15572: Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network…

PriorityP337high7.5CVSS 3.1

AVNACLPRNUINSUCNINAH

EPSS

1.40%

69.6th percentile

Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
debian	tor	< tor 0.4.3.6-1 (bookworm)	tor 0.4.3.6-1 (bookworm)
torproject	tor	< 0.3.5.11	0.3.5.11
torproject	tor	< 0.4.2.8	0.4.2.8
torproject	tor	< 0.4.3.6	0.4.3.6
torproject	tor	—	—
torproject	tor	—	—
torproject	tor	>= 0 < 0.4.3.6-1	0.4.3.6-1
torproject	tor	>= 0 < 0.4.3.6-1	0.4.3.6-1
torproject	tor	>= 0 < 0.4.3.6-1	0.4.3.6-1
torproject	tor	>= 0 < 0.4.3.6-1	0.4.3.6-1

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P

osv7.5HIGH

vendor_debian7.5LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.