NetSight
IP …
high8.1

CVE-2017-8823

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, there is a use-after-free …

Impact

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, there is a use-after-free in onion service v2 during intro-point expiration because the expiring list is mismanaged in certain error cases, aka TROVE-2017-013.

Affected products

VendorProductAffected versions
Tor ProjectTor
before 0.2.5.16
from 0.2.6 before 0.2.8.17
from 0.2.9 before 0.2.9.14
from 0.3.0 before 0.3.0.13
from 0.3.1 before 0.3.1.9
DebianDebian Linux
Versions 8.0, 9.0

Weakness classification

CWE-416

References