MGASA-2026-0382
- Source
- https://advisories.mageia.org/MGASA-2026-0382.html
- Import Source
- https://advisories.mageia.org/MGASA-2026-0382.json
- JSON Data
- https://api.osv.dev/v1/vulns/MGASA-2026-0382
- Upstream
- Published
- 2026-09-08T02:47:35Z
- Modified
- 2026-09-08T03:00:03Z
- Summary
- Updated tor packages fix security vulnerabilities
- Details
-
An out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type (CVE-2026-77642). A NULL write after free when sending a CONFLUX_SWITCH cell fails, resulting in a crash (CVE-2026-77641). An infinite loop when decompressing a truncated zlib/gzip stream with done=1 (CVE-2026-77640). A compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams (CVE-2026-77639). A race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach (CVE-2026-77638). A use-after-free that a malicious exit node could use to crash a client (CVE-2026-77587). Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams (CVE-2026-77584).
- References
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:10 / tor
Package
- Name
- tor
- Purl
- pkg:rpm/mageia/tor?arch=source&distro=mageia-10
Mageia:9 / tor
Package
- Name
- tor
- Purl
- pkg:rpm/mageia/tor?arch=source&distro=mageia-9