Yep. You can read a lot more about it here:
https://bugs.launchpad.net/ubuntu/+source/tor/+bug/328442
and back from 2007 here:
http://www.mailinglistarchive.com/ubuntu-devel@xxxxxxxxxxxxxxxx/msg24404.html
Ubuntu hardy and intrepid are still shipping known-remote-vulnerable
versions of Tor. The version they have in Intrepid is even
known-remote-root-vulnerable. And they still haven't gotten around to
fixing it.
If you're going to include Tor in your distribution, you really have
to maintain it. Since Ubuntu doesn't maintain packages in its
Universe,
it seemed like the smartest move to make sure we don't keep having
this
problem with every new Ubuntu version.