An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006. The v3 onion service descriptor parsing allows out-of-bounds memory access, and a client crash, via a crafted onion service descriptor
{
"extracted_events": [
{
"cpe": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "0.3.5.15"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.4.0.0"
},
{
"fixed": "0.4.4.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.4.5.0"
},
{
"fixed": "0.4.5.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.4.6.0"
},
{
"fixed": "0.4.6.5"
}
],
"source": "CPE_RANGE"
}
]
}
{
"extracted_events": [
{
"cpe": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "0.3.5.15"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.4.0.0"
},
{
"fixed": "0.4.4.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.4.5.0"
},
{
"fixed": "0.4.5.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.4.6.0"
},
{
"fixed": "0.4.6.5"
}
],
"source": "CPE_RANGE"
}
]
}