[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-commits] [tor/maint-0.4.0] Add changes file for #30040.
commit 2cdc6b2005d2ad09b44cf9a455a70f258e7f6fca
Author: George Kadianakis <desnacked@xxxxxxxxxx>
Date: Tue Apr 9 17:30:14 2019 +0300
Add changes file for #30040.
---
changes/bug30040 | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/changes/bug30040 b/changes/bug30040
new file mode 100644
index 000000000..7d80528a1
--- /dev/null
+++ b/changes/bug30040
@@ -0,0 +1,9 @@
+ o Minor bugfixes (security):
+ - Fix a potential double free bug when reading huge bandwidth files. The
+ issue is not exploitable in the current Tor network because the
+ vulnerable code is only reached when directory authorities read bandwidth
+ files, but bandwidth files come from a trusted source (usually the
+ authorities themselves). Furthermore, the issue is only exploitable in
+ rare (non-POSIX) 32-bit architectures which are not used by any of the
+ current authorities. Fixes bug 30040; bugfix on 0.3.5.1-alpha. Bug found
+ and fixed by Tobias Stoeckmann.
_______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits