CVE-2012-3518
tor - several
EPSS 1.5%
Description
The networkstatus_parse_vote_from_string function in routerparse.c in Tor before 0.2.2.38 does not properly handle an invalid flavor name, which allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted (1) vote document or (2) consensus document.
How to fix CVE-2012-3518
To remediate CVE-2012-3518, upgrade the affected package to a fixed version below.
- Debian/tor—upgrade to 0.2.3.20-rc-1 or later
- Debian/tor—upgrade to 0.2.2.39-1 or later
Is CVE-2012-3518 being exploited?
Low — EPSS is 1.5%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 0.2.3.20-rc-1
- from 0, < 0.2.2.39-1