https://bugzilla.novell.com/show_bug.cgi?id=780620 https://bugzilla.novell.com/show_bug.cgi?id=780620#c1 --- Comment #1 from Bernhard Wiedemann 2012-09-15 17:00:14 CEST --- This is an autogenerated message for OBS integration: This bug (780620) was mentioned in https://build.opensuse.org/request/show/134421 Factory / tor -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=780620 https://bugzilla.novell.com/show_bug.cgi?id=780620#c Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|tor CVE-2012-4419 update to |VUL-0: tor: CVE-2012-4419 |0.2.2.39 fixes two |update to 0.2.2.39 fixes |opportunities for remotely |two opportunities for |triggerable assertions |remotely triggerable | |assertions -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=780620 https://bugzilla.novell.com/show_bug.cgi?id=780620#c4 --- Comment #4 from Sebastian Krahmer 2012-09-17 11:26:52 UTC --- Thx. Accepted request. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=780620 https://bugzilla.novell.com/show_bug.cgi?id=780620#c5 --- Comment #5 from Matthias Weckbecker 2012-09-17 14:33:13 CEST --- For documentation purpose: CVE-2012-4922 is also related to this issue. Do we fix it as version upgrade or will be backport? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=780620 https://bugzilla.novell.com/show_bug.cgi?id=780620#c7 --- Comment #7 from Andreas Stieger 2012-09-17 13:33:25 UTC --- Fix for CVE-2012-4922 is actually included in the updated package, the information was not available to me at the time of the report. I will submit an updated package with CVEs lining up in the change log as follows: o Security fixes: - Fix an assertion failure in tor_timegm() that could be triggered by a badly formatted directory object. Bug found by fuzzing with Radamsa. Fixes bug 6811; bugfix on 0.2.0.20-rc. CVE-2012-4922 - Do not crash when comparing an address with port value 0 to an address policy. This bug could have been used to cause a remote assertion failure by or against directory authorities, or to allow some applications to crash clients. Fixes bug 6690; bugfix on 0.2.1.10-alpha. CVE-2012-4419 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=780620 https://bugzilla.novell.com/show_bug.cgi?id=780620#c Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard|obs:running:901:moderate | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=780620 https://bugzilla.novell.com/show_bug.cgi?id=780620#c10 --- Comment #10 from Swamp Workflow Management 2012-10-02 08:08:47 UTC --- openSUSE-SU-2012:1278-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 780620 CVE References: CVE-2012-4419,CVE-2012-4922 Sources used: openSUSE 12.2 (src): tor-0.2.2.39-3.9.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.