CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
80.1%
Severity: High
Date : 2017-12-16
CVE-ID : CVE-2017-8819 CVE-2017-8820 CVE-2017-8822 CVE-2017-8823
Package : tor
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-539
The package tor before version 0.3.1.9-1 is vulnerable to multiple
issues including arbitrary code execution, information disclosure and
denial of service.
Upgrade to 0.3.1.9-1.
The problems have been fixed upstream in version 0.3.1.9.
None.
An issue has been found in the way Tor before 0.3.1.9 checked for
replays, leading to a possible traffic confirmation attack.
A denial of service issue where an attacker could crash a directory
authority using a malformed router descriptor has been found in Tor
before 0.3.1.9.
In Tor before 0.3.1.9, relays (that have incompletely downloaded
descriptors) can pick themselves in a circuit path, leading to a
degradation of anonymity, aka TROVE-2017-012.
A use-after-free vulnerability has been found in Tor before 0.3.1.9,
leading to a crash of v2 Tor onion services when they failed to open
circuits while expiring introduction points.
A remote attacker might be able to reduce the anonymity of Tor users,
cause a denial of service or execute arbitrary code on the affected
host.
https://blog.torproject.org/new-stable-tor-releases-security-fixes-0319-03013-02914-02817-02516
https://trac.torproject.org/projects/tor/ticket/24244
https://trac.torproject.org/projects/tor/ticket/24245
https://bugs.torproject.org/21534
https://bugs.torproject.org/24333
https://trac.torproject.org/projects/tor/ticket/24313
https://security.archlinux.org/CVE-2017-8819
https://security.archlinux.org/CVE-2017-8820
https://security.archlinux.org/CVE-2017-8822
https://security.archlinux.org/CVE-2017-8823
blog.torproject.org/new-stable-tor-releases-security-fixes-0319-03013-02914-02817-02516
bugs.torproject.org/21534
bugs.torproject.org/24333
security.archlinux.org/AVG-539
security.archlinux.org/CVE-2017-8819
security.archlinux.org/CVE-2017-8820
security.archlinux.org/CVE-2017-8822
security.archlinux.org/CVE-2017-8823
trac.torproject.org/projects/tor/ticket/24244
trac.torproject.org/projects/tor/ticket/24245
trac.torproject.org/projects/tor/ticket/24313
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
80.1%