Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
tor-0.2.8.11-1.1 on GA media

Notes

Title of the patch
tor-0.2.8.11-1.1 on GA media
Description of the patch
These are all security issues fixed in the tor-0.2.8.11-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-10423
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "tor-0.2.8.11-1.1 on GA media",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "These are all security issues fixed in the tor-0.2.8.11-1.1 package on the GA media of openSUSE Tumbleweed.",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "openSUSE-Tumbleweed-2024-10423",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10423-1.json",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2011-0427 page",
            url: "https://www.suse.com/security/cve/CVE-2011-0427/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2011-2768 page",
            url: "https://www.suse.com/security/cve/CVE-2011-2768/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2011-2769 page",
            url: "https://www.suse.com/security/cve/CVE-2011-2769/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2011-2778 page",
            url: "https://www.suse.com/security/cve/CVE-2011-2778/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2011-4576 page",
            url: "https://www.suse.com/security/cve/CVE-2011-4576/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2011-4894 page",
            url: "https://www.suse.com/security/cve/CVE-2011-4894/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2011-4895 page",
            url: "https://www.suse.com/security/cve/CVE-2011-4895/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2011-4896 page",
            url: "https://www.suse.com/security/cve/CVE-2011-4896/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2011-4897 page",
            url: "https://www.suse.com/security/cve/CVE-2011-4897/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2012-3517 page",
            url: "https://www.suse.com/security/cve/CVE-2012-3517/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2012-3518 page",
            url: "https://www.suse.com/security/cve/CVE-2012-3518/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2012-3519 page",
            url: "https://www.suse.com/security/cve/CVE-2012-3519/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2012-4419 page",
            url: "https://www.suse.com/security/cve/CVE-2012-4419/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2012-4922 page",
            url: "https://www.suse.com/security/cve/CVE-2012-4922/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2012-5573 page",
            url: "https://www.suse.com/security/cve/CVE-2012-5573/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2013-7295 page",
            url: "https://www.suse.com/security/cve/CVE-2013-7295/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2014-0160 page",
            url: "https://www.suse.com/security/cve/CVE-2014-0160/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2014-5117 page",
            url: "https://www.suse.com/security/cve/CVE-2014-5117/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2015-2688 page",
            url: "https://www.suse.com/security/cve/CVE-2015-2688/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2015-2689 page",
            url: "https://www.suse.com/security/cve/CVE-2015-2689/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2015-2928 page",
            url: "https://www.suse.com/security/cve/CVE-2015-2928/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2015-2929 page",
            url: "https://www.suse.com/security/cve/CVE-2015-2929/",
         },
      ],
      title: "tor-0.2.8.11-1.1 on GA media",
      tracking: {
         current_release_date: "2024-06-15T00:00:00Z",
         generator: {
            date: "2024-06-15T00:00:00Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "openSUSE-SU-2024:10423-1",
         initial_release_date: "2024-06-15T00:00:00Z",
         revision_history: [
            {
               date: "2024-06-15T00:00:00Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "tor-0.2.8.11-1.1.aarch64",
                        product: {
                           name: "tor-0.2.8.11-1.1.aarch64",
                           product_id: "tor-0.2.8.11-1.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "tor-0.2.8.11-1.1.ppc64le",
                        product: {
                           name: "tor-0.2.8.11-1.1.ppc64le",
                           product_id: "tor-0.2.8.11-1.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "tor-0.2.8.11-1.1.s390x",
                        product: {
                           name: "tor-0.2.8.11-1.1.s390x",
                           product_id: "tor-0.2.8.11-1.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "tor-0.2.8.11-1.1.x86_64",
                        product: {
                           name: "tor-0.2.8.11-1.1.x86_64",
                           product_id: "tor-0.2.8.11-1.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "openSUSE Tumbleweed",
                        product: {
                           name: "openSUSE Tumbleweed",
                           product_id: "openSUSE Tumbleweed",
                           product_identification_helper: {
                              cpe: "cpe:/o:opensuse:tumbleweed",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "tor-0.2.8.11-1.1.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
            },
            product_reference: "tor-0.2.8.11-1.1.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tor-0.2.8.11-1.1.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
            },
            product_reference: "tor-0.2.8.11-1.1.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tor-0.2.8.11-1.1.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
            },
            product_reference: "tor-0.2.8.11-1.1.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tor-0.2.8.11-1.1.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            },
            product_reference: "tor-0.2.8.11-1.1.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2011-0427",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2011-0427",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Heap-based buffer overflow in Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2011-0427",
               url: "https://www.suse.com/security/cve/CVE-2011-0427",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2011-0427",
      },
      {
         cve: "CVE-2011-2768",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2011-2768",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Tor before 0.2.2.34, when configured as a client or bridge, sends a TLS certificate chain as part of an outgoing OR connection, which allows remote relays to bypass intended anonymity properties by reading this chain and then determining the set of entry guards that the client or bridge had selected.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2011-2768",
               url: "https://www.suse.com/security/cve/CVE-2011-2768",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2011-2768",
      },
      {
         cve: "CVE-2011-2769",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2011-2769",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Tor before 0.2.2.34, when configured as a bridge, accepts the CREATE and CREATE_FAST values in the Command field of a cell within an OR connection that it initiated, which allows remote relays to enumerate bridges by using these values.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2011-2769",
               url: "https://www.suse.com/security/cve/CVE-2011-2769",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2011-2769",
      },
      {
         cve: "CVE-2011-2778",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2011-2778",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Multiple heap-based buffer overflows in Tor before 0.2.2.35 allow remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code by (1) establishing a SOCKS connection to SocksPort or (2) leveraging a SOCKS proxy configuration.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2011-2778",
               url: "https://www.suse.com/security/cve/CVE-2011-2778",
            },
            {
               category: "external",
               summary: "SUSE Bug 739133 for CVE-2011-2778",
               url: "https://bugzilla.suse.com/739133",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2011-2778",
      },
      {
         cve: "CVE-2011-4576",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2011-4576",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2011-4576",
               url: "https://www.suse.com/security/cve/CVE-2011-4576",
            },
            {
               category: "external",
               summary: "SUSE Bug 739719 for CVE-2011-4576",
               url: "https://bugzilla.suse.com/739719",
            },
            {
               category: "external",
               summary: "SUSE Bug 758060 for CVE-2011-4576",
               url: "https://bugzilla.suse.com/758060",
            },
            {
               category: "external",
               summary: "SUSE Bug 778825 for CVE-2011-4576",
               url: "https://bugzilla.suse.com/778825",
            },
            {
               category: "external",
               summary: "SUSE Bug 854391 for CVE-2011-4576",
               url: "https://bugzilla.suse.com/854391",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2011-4576",
      },
      {
         cve: "CVE-2011-4894",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2011-4894",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Tor before 0.2.2.34, when configured as a bridge, uses direct DirPort access instead of a Tor TLS connection for a directory fetch, which makes it easier for remote attackers to enumerate bridges by observing DirPort connections.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2011-4894",
               url: "https://www.suse.com/security/cve/CVE-2011-4894",
            },
            {
               category: "external",
               summary: "SUSE Bug 739133 for CVE-2011-4894",
               url: "https://bugzilla.suse.com/739133",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2011-4894",
      },
      {
         cve: "CVE-2011-4895",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2011-4895",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Tor before 0.2.2.34, when configured as a bridge, sets up circuits through a process different from the process used by a client, which makes it easier for remote attackers to enumerate bridges by observing circuit building.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2011-4895",
               url: "https://www.suse.com/security/cve/CVE-2011-4895",
            },
            {
               category: "external",
               summary: "SUSE Bug 739133 for CVE-2011-4895",
               url: "https://bugzilla.suse.com/739133",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2011-4895",
      },
      {
         cve: "CVE-2011-4896",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2011-4896",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Tor before 0.2.2.24-alpha continues to use a reachable bridge that was previously configured but is not currently configured, which might allow remote attackers to obtain sensitive information about clients in opportunistic circumstances by monitoring network traffic to the bridge port.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2011-4896",
               url: "https://www.suse.com/security/cve/CVE-2011-4896",
            },
            {
               category: "external",
               summary: "SUSE Bug 739133 for CVE-2011-4896",
               url: "https://bugzilla.suse.com/739133",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2011-4896",
      },
      {
         cve: "CVE-2011-4897",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2011-4897",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Tor before 0.2.2.25-alpha, when configured as a relay without the Nickname configuration option, uses the local hostname as the Nickname value, which allows remote attackers to obtain potentially sensitive information by reading this value.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2011-4897",
               url: "https://www.suse.com/security/cve/CVE-2011-4897",
            },
            {
               category: "external",
               summary: "SUSE Bug 739133 for CVE-2011-4897",
               url: "https://bugzilla.suse.com/739133",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2011-4897",
      },
      {
         cve: "CVE-2012-3517",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2012-3517",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Use-after-free vulnerability in dns.c in Tor before 0.2.2.38 might allow remote attackers to cause a denial of service (daemon crash) via vectors related to failed DNS requests.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2012-3517",
               url: "https://www.suse.com/security/cve/CVE-2012-3517",
            },
            {
               category: "external",
               summary: "SUSE Bug 776642 for CVE-2012-3517",
               url: "https://bugzilla.suse.com/776642",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2012-3517",
      },
      {
         cve: "CVE-2012-3518",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2012-3518",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The networkstatus_parse_vote_from_string function in routerparse.c in Tor before 0.2.2.38 does not properly handle an invalid flavor name, which allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted (1) vote document or (2) consensus document.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2012-3518",
               url: "https://www.suse.com/security/cve/CVE-2012-3518",
            },
            {
               category: "external",
               summary: "SUSE Bug 776642 for CVE-2012-3518",
               url: "https://bugzilla.suse.com/776642",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2012-3518",
      },
      {
         cve: "CVE-2012-3519",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2012-3519",
            },
         ],
         notes: [
            {
               category: "general",
               text: "routerlist.c in Tor before 0.2.2.38 uses a different amount of time for relay-list iteration depending on which relay is chosen, which might allow remote attackers to obtain sensitive information about relay selection via a timing side-channel attack.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2012-3519",
               url: "https://www.suse.com/security/cve/CVE-2012-3519",
            },
            {
               category: "external",
               summary: "SUSE Bug 776642 for CVE-2012-3519",
               url: "https://bugzilla.suse.com/776642",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2012-3519",
      },
      {
         cve: "CVE-2012-4419",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2012-4419",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The compare_tor_addr_to_addr_policy function in or/policies.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.21-rc, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a zero-valued port field that is not properly handled during policy comparison.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2012-4419",
               url: "https://www.suse.com/security/cve/CVE-2012-4419",
            },
            {
               category: "external",
               summary: "SUSE Bug 780620 for CVE-2012-4419",
               url: "https://bugzilla.suse.com/780620",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2012-4419",
      },
      {
         cve: "CVE-2012-4922",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2012-4922",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The tor_timegm function in common/util.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.22-rc, does not properly validate time values, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed directory object, a different vulnerability than CVE-2012-4419.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2012-4922",
               url: "https://www.suse.com/security/cve/CVE-2012-4922",
            },
            {
               category: "external",
               summary: "SUSE Bug 780620 for CVE-2012-4922",
               url: "https://bugzilla.suse.com/780620",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2012-4922",
      },
      {
         cve: "CVE-2012-5573",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2012-5573",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The connection_edge_process_relay_cell function in or/relay.c in Tor before 0.2.3.25 maintains circuits even if an unexpected SENDME cell arrives, which might allow remote attackers to cause a denial of service (memory consumption or excessive cell reception rate) or bypass intended flow-control restrictions via a RELAY_COMMAND_SENDME command.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2012-5573",
               url: "https://www.suse.com/security/cve/CVE-2012-5573",
            },
            {
               category: "external",
               summary: "SUSE Bug 791374 for CVE-2012-5573",
               url: "https://bugzilla.suse.com/791374",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2012-5573",
      },
      {
         cve: "CVE-2013-7295",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2013-7295",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2013-7295",
               url: "https://www.suse.com/security/cve/CVE-2013-7295",
            },
            {
               category: "external",
               summary: "SUSE Bug 859421 for CVE-2013-7295",
               url: "https://bugzilla.suse.com/859421",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2013-7295",
      },
      {
         cve: "CVE-2014-0160",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2014-0160",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2014-0160",
               url: "https://www.suse.com/security/cve/CVE-2014-0160",
            },
            {
               category: "external",
               summary: "SUSE Bug 872299 for CVE-2014-0160",
               url: "https://bugzilla.suse.com/872299",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2014-0160",
      },
      {
         cve: "CVE-2014-5117",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2014-5117",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAY_EARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAY_EARLY cells as a means of communicating information about hidden service names.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2014-5117",
               url: "https://www.suse.com/security/cve/CVE-2014-5117",
            },
            {
               category: "external",
               summary: "SUSE Bug 889688 for CVE-2014-5117",
               url: "https://bugzilla.suse.com/889688",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2014-5117",
      },
      {
         cve: "CVE-2015-2688",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2015-2688",
            },
         ],
         notes: [
            {
               category: "general",
               text: "buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2015-2688",
               url: "https://www.suse.com/security/cve/CVE-2015-2688",
            },
            {
               category: "external",
               summary: "SUSE Bug 923284 for CVE-2015-2688",
               url: "https://bugzilla.suse.com/923284",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2015-2688",
      },
      {
         cve: "CVE-2015-2689",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2015-2689",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2015-2689",
               url: "https://www.suse.com/security/cve/CVE-2015-2689",
            },
            {
               category: "external",
               summary: "SUSE Bug 923284 for CVE-2015-2689",
               url: "https://bugzilla.suse.com/923284",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2015-2689",
      },
      {
         cve: "CVE-2015-2928",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2015-2928",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The Hidden Service (HS) server implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2015-2928",
               url: "https://www.suse.com/security/cve/CVE-2015-2928",
            },
            {
               category: "external",
               summary: "SUSE Bug 926097 for CVE-2015-2928",
               url: "https://bugzilla.suse.com/926097",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2015-2928",
      },
      {
         cve: "CVE-2015-2929",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2015-2929",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and application exit) via a malformed HS descriptor.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
               "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2015-2929",
               url: "https://www.suse.com/security/cve/CVE-2015-2929",
            },
            {
               category: "external",
               summary: "SUSE Bug 926097 for CVE-2015-2929",
               url: "https://bugzilla.suse.com/926097",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.aarch64",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.ppc64le",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.s390x",
                  "openSUSE Tumbleweed:tor-0.2.8.11-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2015-2929",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.