tor-announce

tor-announce@lists.torproject.org

287 discussions

Tor 0.2.9.10 is released
by Nick Mathewson 01 Mar '17

01 Mar '17

(If you are about to reply saying "please take me off this list", instead please follow these instructions: https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-announce/ You will have to enter the actual email address you used to subscribe.) You can download the source code from https://dist.torproject.org/ but most users should wait for the upcoming Tor Browser release, or for their upcoming system package updates. (0.3.0.4-rc also came out today, but non-stable releases get announced on tor-talk.) Changes in version 0.2.9.10 - 2017-03-01 Tor 0.2.9.10 backports a security fix from a later Tor release. It also includes fixes for some major issues affecting directory authorities, LibreSSL compatibility, and IPv6 correctness. The Tor 0.2.9.x release series is now marked as a long-term-support series. We intend to backport security fixes to 0.2.9.x until at least January of 2020. o Major bugfixes (directory authority, 0.3.0.3-alpha): - During voting, when marking a relay as a probable sybil, do not clear its BadExit flag: sybils can still be bad in other ways too. (We still clear the other flags.) Fixes bug 21108; bugfix on 0.2.0.13-alpha. o Major bugfixes (IPv6 Exits, backport from 0.3.0.3-alpha): - Stop rejecting all IPv6 traffic on Exits whose exit policy rejects any IPv6 addresses. Instead, only reject a port over IPv6 if the exit policy rejects that port on more than an IPv6 /16 of addresses. This bug was made worse by 17027 in 0.2.8.1-alpha, which rejected a relay's own IPv6 address by default. Fixes bug 21357; bugfix on commit 004f3f4e53 in 0.2.4.7-alpha. o Major bugfixes (parsing, also in 0.3.0.4-rc): - Fix an integer underflow bug when comparing malformed Tor versions. This bug could crash Tor when built with --enable-expensive-hardening, or on Tor 0.2.9.1-alpha through Tor 0.2.9.8, which were built with -ftrapv by default. In other cases it was harmless. Part of TROVE-2017-001. Fixes bug 21278; bugfix on 0.0.8pre1. Found by OSS-Fuzz. o Minor features (directory authorities, also in 0.3.0.4-rc): - Directory authorities now reject descriptors that claim to be malformed versions of Tor. Helps prevent exploitation of bug 21278. - Reject version numbers with components that exceed INT32_MAX. Otherwise 32-bit and 64-bit platforms would behave inconsistently. Fixes bug 21450; bugfix on 0.0.8pre1. o Minor features (geoip): - Update geoip and geoip6 to the February 8 2017 Maxmind GeoLite2 Country database. o Minor features (portability, compilation, backport from 0.3.0.3-alpha): - Autoconf now checks to determine if OpenSSL structures are opaque, instead of explicitly checking for OpenSSL version numbers. Part of ticket 21359. - Support building with recent LibreSSL code that uses opaque structures. Closes ticket 21359. o Minor bugfixes (code correctness, also in 0.3.0.4-rc): - Repair a couple of (unreachable or harmless) cases of the risky comparison-by-subtraction pattern that caused bug 21278. o Minor bugfixes (tor-resolve, backport from 0.3.0.3-alpha): - The tor-resolve command line tool now rejects hostnames over 255 characters in length. Previously, it would silently truncate them, which could lead to bugs. Fixes bug 21280; bugfix on 0.0.9pre5. Patch by "junglefowl".

1 0

Tor Browser 6.5 is released
by Nicolas Vigier 25 Jan '17

25 Jan '17

Tor Browser 6.5 is now available from the Tor Browser Project page [1] and also from our distribution directory [2]. 1: https://www.torproject.org/download/download-easy.html 2: https://www.torproject.org/dist/torbrowser/6.5/ This release features important security updates [3] to Firefox. 3: https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/ This is a major release and the first one in the 6.5 series. First of all it fixes the usual critical bugs in Firefox by updating to ESR 45.7.0. It contains version updates to other bundle components as well: Tor to 0.2.9.9, OpenSSL to 1.0.2j, HTTPS-Everywhere to 5.2.9, and NoScript to 2.9.5.3. Besides those updates Tor Browser 6.5 ships with a lot of the improvements we have been working on in the past couple of months. On the security side we always block remote JAR files [4] now and remove the support for SHA-1 HPKP pins [5]. Additionally we backported from an other firefox branch patches to mark JIT pages as non-writable and other crash fixes that could disrupt a Tor Browser session quite reliably. 4: https://trac.torproject.org/projects/tor/ticket/20123 5: https://trac.torproject.org/projects/tor/ticket/19164 With respect to user tracking and fingerprinting we now isolate SharedWorker script requests to the first party domain. We improved our timer resolution spoofing and reduced the timing precision for AudioContext, HTMLMediaElement, and Mediastream elements. We stopped user fingerprinting via internal resource:// URLs, and for Windows users we fixed a regression introduced in Tor Browser 6.0 which could leak the local timezone if JavaScript were enabled. A great deal of our time was spent on improving the usability of Tor Browser. We redesigned the security slider and improved its labels. We moved a lot of Torbutton's privacy settings directly into the respective Firefox menu making it cleaner and more straightforward to use. Finally, we moved as many Torbutton features as possible into Firefox to make it easier for upstreaming them. This allowed us to resolve a couple of window resizing bugs that piled on over the course of the past years. The features mentioned above are only some of the highlights in Tor Browser 6.5. The full changelog since 6.0.8 is: * All Platforms * Update Firefox to 45.7.0esr * Tor to 0.2.9.9 * OpenSSL to 1.0.2j * Update Torbutton to 1.9.6.12 * Bug 16622: Timezone spoofing moved to tor-browser.git * Bug 17334: Move referrer spoofing for .onion domains into tor-browser.git * Bug 8725: Block addon resource and url fingerprinting with nsIContentPolicy * Bug 20701: Allow the directory listing stylesheet in the content policy * Bug 19837: Whitelist internal URLs that Firefox requires for media * Bug 19206: Avoid SOCKS auth and NEWNYM collisions when sharing a tor client * Bug 19273: Improve external app launch handling and associated warnings * Bug 15852: Remove/synchronize Torbutton SOCKS pref logic * Bug 19733: GETINFO response parser doesn't handle AF_UNIX entries + IPv6 * Bug 17767: Make "JavaScript disabled" more visible in Security Slider * Bug 20556: Use pt-BR strings from now on * Bug 20614: Add links to Tor Browser User Manual * Bug 20414: Fix non-rendering arrow on OS X * Bug 20728: Fix bad preferences.xul dimensions * Bug 19898: Use DuckDuckGo on about:tor * Bug 21091: Hide the update check menu entry when running under the sandbox * Bug 19459: Move resizing code to tor-browser.git * Bug 20264: Change security slider to 3 options * Bug 20347: Enhance security slider's custom mode * Bug 20123: Disable remote jar on all security levels * Bug 20244: Move privacy checkboxes to about:preferences#privacy * Bug 17546: Add tooltips to explain our privacy checkboxes * Bug 17904: Allow security settings dialog to resize * Bug 18093: Remove 'Restore Defaults' button * Bug 20373: Prevent redundant dialogs opening * Bug 20318: Remove helpdesk link from about:tor * Bug 21243: Add links for pt, es, and fr Tor Browser manuals * Bug 20753: Remove obsolete StartPage locale strings * Bug 21131: Remove 2016 donation banner * Bug 18980: Remove obsolete toolbar button code * Bug 18238: Remove unused Torbutton code and strings * Bug 20388+20399+20394: Code clean-up * Translation updates * Update Tor Launcher to 0.2.10.3 * Bug 19568: Set CurProcD for Thunderbird/Instantbird * Bug 19432: Remove special handling for Instantbird/Thunderbird * Translation updates * Update HTTPS-Everywhere to 5.2.9 * Update NoScript to 2.9.5.3 * Bug 16622: Spoof timezone with Firefox patch * Bug 17334: Spoof referrer when leaving a .onion domain * Bug 19273: Write C++ patch for external app launch handling * Bug 19459: Size new windows to 1000x1000 or nearest 200x100 (Firefox patch) * Bug 12523: Mark JIT pages as non-writable * Bug 20123: Always block remote jar files * Bug 19193: Reduce timing precision for AudioContext, HTMLMediaElement, and MediaStream * Bug 19164: Remove support for SHA-1 HPKP pins * Bug 19186: KeyboardEvents are only rounding to 100ms * Bug 16998: Isolate preconnect requests to URL bar domain * Bug 19478: Prevent millisecond resolution leaks in File API * Bug 20471: Allow javascript: links from HTTPS first party pages * Bug 20244: Move privacy checkboxes to about:preferences#privacy * Bug 20707: Fix broken preferences tab in non-en-US alpha bundles * Bug 20709: Fix wrong update URL in alpha bundles * Bug 19481: Point the update URL to aus1.torproject.org * Bug 20556: Start using pt-BR instead of pt-PT for Portuguese * Bug 20442: Backport fix for local path disclosure after drag and drop * Bug 20160: Backport fix for broken MP3-playback * Bug 20043: Isolate SharedWorker script requests to first party * Bug 18923: Add script to run all Tor Browser regression tests * Bug 20651: DuckDuckGo does not work with JavaScript disabled * Bug 19336+19835: Enhance about:tbupdate page * Bug 20399+15852: Code clean-up * Windows * Bug 20981: On Windows, check TZ for timezone first * Bug 18175: Maximizing window and restarting leads to non-rounded window size * Bug 13437: Rounded inner window accidentally grows to non-rounded size * OS X * Bug 20590: Badly resized window due to security slider notification bar on OS X * Bug 20439: Make the build PIE on OSX * Linux * Bug 20691: Updater breaks if unix domain sockets are used * Bug 15953: Weird resizing dance on Tor Browser startup * Build system * All platforms * Bug 20927: Upgrade Go to 1.7.4 * Bug 20583: Make the downloads.json file reproducible * Bug 20133: Don't apply OpenSSL patch anymore * Bug 19528: Set MOZ_BUILD_DATE based on Firefox version * Bug 18291: Remove some uses of libfaketime * Bug 18845: Make zip and tar helpers generate reproducible archives * OS X * Bug 20258: Make OS X Tor archive reproducible again * Bug 20184: Make OS X builds reproducible (use clang for compiling tor) * Bug 19856: Make OS X builds reproducible (getting libfaketime back) * Bug 19410: Fix incremental updates by taking signatures into account * Bug 20210: In dmg2mar, extract old mar file to copy permissions to the new one

1 0

Tor 0.2.9.9 is released
by Roger Dingledine 23 Jan '17

23 Jan '17

(If you are about to reply saying "please take me off this list", instead please follow these instructions: https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-announce/ You will have to enter the actual email address you used to subscribe.) Tor 0.2.9.9 fixes a denial-of-service bug where an attacker could cause relays and clients to crash, even if they were not built with the --enable-expensive-hardening option. This bug affects all 0.2.9.x versions, and also affects 0.3.0.1-alpha: all relays running an affected version should upgrade. This release also resolves a client-side onion service reachability bug, and resolves a pair of small portability issues. You can download the source code from https://dist.torproject.org/ but most users should wait for the upcoming Tor Browser release, or for their upcoming system package updates. Changes in version 0.2.9.9 - 2017-01-23 o Major bugfixes (security): - Downgrade the "-ftrapv" option from "always on" to "only on when --enable-expensive-hardening is provided." This hardening option, like others, can turn survivable bugs into crashes -- and having it on by default made a (relatively harmless) integer overflow bug into a denial-of-service bug. Fixes bug 21278 (TROVE-2017-001); bugfix on 0.2.9.1-alpha. o Major bugfixes (client, onion service): - Fix a client-side onion service reachability bug, where multiple socks requests to an onion service (or a single slow request) could cause us to mistakenly mark some of the service's introduction points as failed, and we cache that failure so eventually we run out and can't reach the service. Also resolves a mysterious "Remote server sent bogus reason code 65021" log warning. The bug was introduced in ticket 17218, where we tried to remember the circuit end reason as a uint16_t, which mangled negative values. Partially fixes bug 21056 and fixes bug 20307; bugfix on 0.2.8.1-alpha. o Minor features (geoip): - Update geoip and geoip6 to the January 4 2017 Maxmind GeoLite2 Country database. o Minor bugfixes (portability): - Avoid crashing when Tor is built using headers that contain CLOCK_MONOTONIC_COARSE, but then tries to run on an older kernel without CLOCK_MONOTONIC_COARSE. Fixes bug 21035; bugfix on 0.2.9.1-alpha. - Fix Libevent detection on platforms without Libevent 1 headers installed. Fixes bug 21051; bugfix on 0.2.9.1-alpha.

1 0

Tor 0.2.8.12 is released
by Nick Mathewson 19 Dec '16

19 Dec '16

Hi, all! In addition to today's release of a stable 0.2.9, there's also a new Tor 0.2.8.12 source release. This release backports a fix for bug 21018, a medium-severity denial-of-service issue affecting clients that visit hidden services. See notes on 21018 below for more information. (If you are about to reply saying "please take me off this list", instead please follow these instructions: https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-announce/ . If you have trouble, it is probably because you subscribed using a different address than the one you are trying to unsubscribe with. You will have to enter the actual email address you used to subscribe.) Since 0.2.8 is no longer the most recent stable release, you can download the source from https://dist.torproject.org/ . ============================================================ Changes in version 0.2.8.12 - 2016-12-19 Tor 0.2.8.12 backports a fix for a medium-severity issue (bug 21018 below) where Tor clients could crash when attempting to visit a hostile hidden service. Clients are recommended to upgrade as packages become available for their systems. It also includes an updated list of fallback directories, backported from 0.2.9. Now that the Tor 0.2.9 series is stable, only major bugfixes will be backported to 0.2.8 in the future. o Major bugfixes (parsing, security, backported from 0.2.9.8): - Fix a bug in parsing that could cause clients to read a single byte past the end of an allocated region. This bug could be used to cause hardened clients (built with --enable-expensive-hardening) to crash if they tried to visit a hostile hidden service. Non- hardened clients are only affected depending on the details of their platform's memory allocator. Fixes bug 21018; bugfix on 0.2.0.8-alpha. Found by using libFuzzer. Also tracked as TROVE- 2016-12-002 and as CVE-2016-1254. o Minor features (fallback directory list, backported from 0.2.9.8): - Replace the 81 remaining fallbacks of the 100 originally introduced in Tor 0.2.8.3-alpha in March 2016, with a list of 177 fallbacks (123 new, 54 existing, 27 removed) generated in December 2016. Resolves ticket 20170. o Minor features (geoip, backported from 0.2.9.7-rc): - Update geoip and geoip6 to the December 7 2016 Maxmind GeoLite2 Country database.

1 0

Tor 0.2.9.8 (the first stable 0.2.9) is released!
by Nick Mathewson 19 Dec '16

19 Dec '16

Hi, all! After months of work, a new Tor release series is finally stable. (If you are about to reply saying "please take me off this list", instead please follow these instructions: https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-announce/ . If you have trouble, it is probably because you subscribed using a different address than the one you are trying to unsubscribe with. You will have to enter the actual email address you used to subscribe.) (This release also includes a fix for bug 21018, a medium-severity denial-of-service issue affecting clients that visit hidden services. A new Tor 0.2.8.x release will also be out soon. See notes on 21018 below for more information.) You can download the source code from the usual place on the website. Packages should be up within the next few days, with a TorBrowser release planned for early January. ============================================================ Changes in version 0.2.9.8 - 2016-12-19 Tor 0.2.9.8 is the first stable release of the Tor 0.2.9 series. The Tor 0.2.9 series makes mandatory a number of security features that were formerly optional. It includes support for a new shared- randomness protocol that will form the basis for next generation hidden services, includes a single-hop hidden service mode for optimizing .onion services that don't actually want to be hidden, tries harder not to overload the directory authorities with excessive downloads, and supports a better protocol versioning scheme for improved compatibility with other implementations of the Tor protocol. And of course, there are numerous other bugfixes and improvements. This release also includes a fix for a medium-severity issue (bug 21018 below) where Tor clients could crash when attempting to visit a hostile hidden service. Clients are recommended to upgrade as packages become available for their systems. Below are listed the changes since Tor 0.2.8.11. For a list of changes since 0.2.9.7-rc, see the ChangeLog file. o New system requirements: - When building with OpenSSL, Tor now requires version 1.0.1 or later. OpenSSL 1.0.0 and earlier are no longer supported by the OpenSSL team, and should not be used. Closes ticket 20303. - Tor now requires Libevent version 2.0.10-stable or later. Older versions of Libevent have less efficient backends for several platforms, and lack the DNS code that we use for our server-side DNS support. This implements ticket 19554. - Tor now requires zlib version 1.2 or later, for security, efficiency, and (eventually) gzip support. (Back when we started, zlib 1.1 and zlib 1.0 were still found in the wild. 1.2 was released in 2003. We recommend the latest version.) o Deprecated features: - A number of DNS-cache-related sub-options for client ports are now deprecated for security reasons, and may be removed in a future version of Tor. (We believe that client-side DNS caching is a bad idea for anonymity, and you should not turn it on.) The options are: CacheDNS, CacheIPv4DNS, CacheIPv6DNS, UseDNSCache, UseIPv4Cache, and UseIPv6Cache. - A number of options are deprecated for security reasons, and may be removed in a future version of Tor. The options are: AllowDotExit, AllowInvalidNodes, AllowSingleHopCircuits, AllowSingleHopExits, ClientDNSRejectInternalAddresses, CloseHSClientCircuitsImmediatelyOnTimeout, CloseHSServiceRendCircuitsImmediatelyOnTimeout, ExcludeSingleHopRelays, FastFirstHopPK, TLSECGroup, UseNTorHandshake, and WarnUnsafeSocks. - The *ListenAddress options are now deprecated as unnecessary: the corresponding *Port options should be used instead. These options may someday be removed. The affected options are: ControlListenAddress, DNSListenAddress, DirListenAddress, NATDListenAddress, ORListenAddress, SocksListenAddress, and TransListenAddress. o Major bugfixes (parsing, security, new since 0.2.9.7-rc): - Fix a bug in parsing that could cause clients to read a single byte past the end of an allocated region. This bug could be used to cause hardened clients (built with --enable-expensive-hardening) to crash if they tried to visit a hostile hidden service. Non- hardened clients are only affected depending on the details of their platform's memory allocator. Fixes bug 21018; bugfix on 0.2.0.8-alpha. Found by using libFuzzer. Also tracked as TROVE- 2016-12-002 and as CVE-2016-1254. o Major features (build, hardening): - Tor now builds with -ftrapv by default on compilers that support it. This option detects signed integer overflow (which C forbids), and turns it into a hard-failure. We do not apply this option to code that needs to run in constant time to avoid side-channels; instead, we use -fwrapv in that code. Closes ticket 17983. - When --enable-expensive-hardening is selected, stop applying the clang/gcc sanitizers to code that needs to run in constant time. Although we are aware of no introduced side-channels, we are not able to prove that there are none. Related to ticket 17983. o Major features (circuit building, security): - Authorities, relays, and clients now require ntor keys in all descriptors, for all hops (except for rare hidden service protocol cases), for all circuits, and for all other roles. Part of ticket 19163. - Authorities, relays, and clients only use ntor, except for rare cases in the hidden service protocol. Part of ticket 19163. o Major features (compilation): - Our big list of extra GCC warnings is now enabled by default when building with GCC (or with anything like Clang that claims to be GCC-compatible). To make all warnings into fatal compilation errors, pass --enable-fatal-warnings to configure. Closes ticket 19044. - Use the Autoconf macro AC_USE_SYSTEM_EXTENSIONS to automatically turn on C and POSIX extensions. (Previously, we attempted to do this on an ad hoc basis.) Closes ticket 19139. o Major features (directory authorities, hidden services): - Directory authorities can now perform the shared randomness protocol specified by proposal 250. Using this protocol, directory authorities generate a global fresh random value every day. In the future, this value will be used by hidden services to select HSDirs. This release implements the directory authority feature; the hidden service side will be implemented in the future as part of proposal 224. Resolves ticket 16943; implements proposal 250. o Major features (downloading, random exponential backoff): - When we fail to download an object from a directory service, wait for an (exponentially increasing) randomized amount of time before retrying, rather than a fixed interval as we did before. This prevents a group of Tor instances from becoming too synchronized, or a single Tor instance from becoming too predictable, in its download schedule. Closes ticket 15942. o Major features (resource management): - Tor can now notice it is about to run out of sockets, and preemptively close connections of lower priority. (This feature is off by default for now, since the current prioritizing method is yet not mature enough. You can enable it by setting "DisableOOSCheck 0", but watch out: it might close some sockets you would rather have it keep.) Closes ticket 18640. o Major features (single-hop "hidden" services): - Add experimental HiddenServiceSingleHopMode and HiddenServiceNonAnonymousMode options. When both are set to 1, every hidden service on that Tor instance becomes a non-anonymous Single Onion Service. Single Onions make one-hop (direct) connections to their introduction and rendezvous points. One-hop circuits make Single Onion servers easily locatable, but clients remain location-anonymous. This is compatible with the existing hidden service implementation, and works on the current Tor network without any changes to older relays or clients. Implements proposal 260, completes ticket 17178. Patch by teor and asn. o Major features (subprotocol versions): - Tor directory authorities now vote on a set of recommended "subprotocol versions", and on a set of required subprotocol versions. Clients and relays that lack support for a _required_ subprotocol version will not start; those that lack support for a _recommended_ subprotocol version will warn the user to upgrade. This change allows compatible implementations of the Tor protocol(s) to exist without pretending to be 100% bug-compatible with particular releases of Tor itself. Closes ticket 19958; implements part of proposal 264. o Major bugfixes (circuit building): - Hidden service client-to-intro-point and service-to-rendezvous- point circuits use the TAP key supplied by the protocol, to avoid epistemic attacks. Fixes bug 19163; bugfix on 0.2.4.18-rc. o Major bugfixes (download scheduling): - Avoid resetting download status for consensuses hourly, since we already have another, smarter retry mechanism. Fixes bug 8625; bugfix on 0.2.0.9-alpha. - If a consensus expires while we are waiting for certificates to download, stop waiting for certificates. - If we stop waiting for certificates less than a minute after we started downloading them, do not consider the certificate download failure a separate failure. Fixes bug 20533; bugfix on 0.2.0.9-alpha. - When using exponential backoff in test networks, use a lower exponent, so the delays do not vary as much. This helps test networks bootstrap consistently. Fixes bug 20597; bugfix on 20499. o Major bugfixes (exit policies): - Avoid disclosing exit outbound bind addresses, configured port bind addresses, and local interface addresses in relay descriptors by default under ExitPolicyRejectPrivate. Instead, only reject these (otherwise unlisted) addresses if ExitPolicyRejectLocalInterfaces is set. Fixes bug 18456; bugfix on 0.2.7.2-alpha. Patch by teor. o Major bugfixes (hidden services): - Allow Tor clients with appropriate controllers to work with FetchHidServDescriptors set to 0. Previously, this option also disabled descriptor cache lookup, thus breaking hidden services entirely. Fixes bug 18704; bugfix on 0.2.0.20-rc. Patch by "twim". - Clients now require hidden services to include the TAP keys for their intro points in the hidden service descriptor. This prevents an inadvertent upgrade to ntor, which a malicious hidden service could use to distinguish clients by consensus version. Fixes bug 20012; bugfix on 0.2.4.8-alpha. Patch by teor. o Major bugfixes (relay, resolver, logging): - For relays that don't know their own address, avoid attempting a local hostname resolve for each descriptor we download. This will cut down on the number of "Success: chose address 'x.x.x.x'" log lines, and also avoid confusing clock jumps if the resolver is slow. Fixes bugs 20423 and 20610; bugfix on 0.2.8.1-alpha. o Minor features (port flags): - Add new flags to the *Port options to give finer control over which requests are allowed. The flags are NoDNSRequest, NoOnionTraffic, and the synthetic flag OnionTrafficOnly, which is equivalent to NoDNSRequest, NoIPv4Traffic, and NoIPv6Traffic. Closes enhancement 18693; patch by "teor". o Minor features (build, hardening): - Detect and work around a libclang_rt problem that would prevent clang from finding __mulodi4() on some 32-bit platforms, and thus keep -ftrapv from linking on those systems. Closes ticket 19079. - When building on a system without runtime support for the runtime hardening options, try to log a useful warning at configuration time, rather than an incomprehensible warning at link time. If expensive hardening was requested, this warning becomes an error. Closes ticket 18895. o Minor features (client, directory): - Since authorities now omit all routers that lack the Running and Valid flags, we assume that any relay listed in the consensus must have those flags. Closes ticket 20001; implements part of proposal 272. o Minor features (code safety): - In our integer-parsing functions, ensure that the maximum value we allow is no smaller than the minimum value. Closes ticket 19063; patch from "U+039b". o Minor features (compilation, portability): - Compile correctly on MacOS 10.12 (aka "Sierra"). Closes ticket 20241. o Minor features (config): - Warn users when descriptor and port addresses are inconsistent. Mitigates bug 13953; patch by teor. o Minor features (controller): - Allow controllers to configure basic client authorization on hidden services when they create them with the ADD_ONION controller command. Implements ticket 15588. Patch by "special". - Fire a STATUS_SERVER controller event whenever the hibernation status changes between "awake"/"soft"/"hard". Closes ticket 18685. - Implement new GETINFO queries for all downloads that use download_status_t to schedule retries. This allows controllers to examine the schedule for pending downloads. Closes ticket 19323. o Minor features (development tools, etags): - Teach the "make tags" Makefile target how to correctly find "MOCK_IMPL" function definitions. Patch from nherring; closes ticket 16869. o Minor features (directory authority): - After voting, if the authorities decide that a relay is not "Valid", they no longer include it in the consensus at all. Closes ticket 20002; implements part of proposal 272. - Directory authorities now only give the Guard flag to a relay if they are also giving it the Stable flag. This change allows us to simplify path selection for clients. It should have minimal effect in practice, since >99% of Guards already have the Stable flag. Implements ticket 18624. - Directory authorities now write their v3-status-votes file out to disk earlier in the consensus process, so we have a record of the votes even if we abort the consensus process. Resolves ticket 19036. o Minor features (fallback directory list, new since 0.2.9.7-rc): - Replace the 81 remaining fallbacks of the 100 originally introduced in Tor 0.2.8.3-alpha in March 2016, with a list of 177 fallbacks (123 new, 54 existing, 27 removed) generated in December 2016. Resolves ticket 20170. o Minor features (hidden service): - Stop being so strict about the payload length of "rendezvous1" cells. We used to be locked in to the "TAP" handshake length, and now we can handle better handshakes like "ntor". Resolves ticket 18998. o Minor features (infrastructure, time): - Tor now includes an improved timer backend, so that we can efficiently support tens or hundreds of thousands of concurrent timers, as will be needed for some of our planned anti-traffic- analysis work. This code is based on William Ahern's "timeout.c" project, which implements a "tickless hierarchical timing wheel". Closes ticket 18365. - Tor now uses the operating system's monotonic timers (where available) for internal fine-grained timing. Previously we would look at the system clock, and then attempt to compensate for the clock running backwards. Closes ticket 18908. o Minor features (logging): - Add a set of macros to check nonfatal assertions, for internal use. Migrating more of our checks to these should help us avoid needless crash bugs. Closes ticket 18613. - Provide a more useful warning message when configured with an invalid Nickname. Closes ticket 18300; patch from "icanhasaccount". - When dumping unparseable router descriptors, optionally store them in separate files, named by digest, up to a configurable size limit. You can change the size limit by setting the MaxUnparseableDescSizeToLog option, and disable this feature by setting that option to 0. Closes ticket 18322. o Minor features (performance): - Change the "optimistic data" extension from "off by default" to "on by default". The default was ordinarily overridden by a consensus option, but when clients were bootstrapping for the first time, they would not have a consensus to get the option from. Changing this default saves a round-trip during startup. Closes ticket 18815. o Minor features (relay, usability): - When the directory authorities refuse a bad relay's descriptor, encourage the relay operator to contact us. Many relay operators won't notice this line in their logs, but it's a win if even a few learn why we don't like what their relay was doing. Resolves ticket 18760. o Minor features (security, TLS): - Servers no longer support clients that lack AES ciphersuites. (3DES is no longer considered an acceptable cipher.) We believe that no such Tor clients currently exist, since Tor has required OpenSSL 0.9.7 or later since 2009. Closes ticket 19998. o Minor features (testing): - Disable memory protections on OpenBSD when performing our unit tests for memwipe(). The test deliberately invokes undefined behavior, and the OpenBSD protections interfere with this. Patch from "rubiate". Closes ticket 20066. - Move the test-network.sh script to chutney, and modify tor's test- network.sh to call the (newer) chutney version when available. Resolves ticket 19116. Patch by teor. - Use the lcov convention for marking lines as unreachable, so that we don't count them when we're generating test coverage data. Update our coverage tools to understand this convention. Closes ticket 16792. - Our link-handshake unit tests now check that when invalid handshakes fail, they fail with the error messages we expected. - Our unit testing code that captures log messages no longer prevents them from being written out if the user asked for them (by passing --debug or --info or --notice or --warn to the "test" binary). This change prevents us from missing unexpected log messages simply because we were looking for others. Related to ticket 19999. - The unit tests now log all warning messages with the "BUG" flag. Previously, they only logged errors by default. This change will help us make our testing code more correct, and make sure that we only hit this code when we mean to. In the meantime, however, there will be more warnings in the unit test logs than before. This is preparatory work for ticket 19999. - The unit tests now treat any failure of a "tor_assert_nonfatal()" assertion as a test failure. - We've done significant work to make the unit tests run faster. o Minor features (testing, ipv6): - Add the hs-ipv6 chutney target to make test-network-all's IPv6 tests. Remove bridges+hs, as it's somewhat redundant. This requires a recent chutney version that supports IPv6 clients, relays, and authorities. Closes ticket 20069; patch by teor. - Add the single-onion and single-onion-ipv6 chutney targets to "make test-network-all". This requires a recent chutney version with the single onion network flavors (git c72a652 or later). Closes ticket 20072; patch by teor. o Minor features (Tor2web): - Make Tor2web clients respect ReachableAddresses. This feature was inadvertently enabled in 0.2.8.6, then removed by bugfix 19973 on 0.2.8.7. Implements feature 20034. Patch by teor. o Minor features (unix domain sockets): - When configuring a unix domain socket for a SocksPort, ControlPort, or Hidden service, you can now wrap the address in quotes, using C-style escapes inside the quotes. This allows unix domain socket paths to contain spaces. Resolves ticket 18753. o Minor features (user interface): - Tor now supports the ability to declare options deprecated, so that we can recommend that people stop using them. Previously, this was done in an ad-hoc way. There is a new --list-deprecated-options command-line option to list all of the deprecated options. Closes ticket 19820. o Minor features (virtual addresses): - Increase the maximum number of bits for the IPv6 virtual network prefix from 16 to 104. In this way, the condition for address allocation is less restrictive. Closes ticket 20151; feature on 0.2.4.7-alpha. o Minor bug fixes (circuits): - Use the CircuitBuildTimeout option whenever LearnCircuitBuildTimeout is disabled. Previously, we would respect the option when a user disabled it, but not when it was disabled because some other option was set. Fixes bug 20073; bugfix on 0.2.4.12-alpha. Patch by teor. o Minor bugfixes (build): - The current Git revision when building from a local repository is now detected correctly when using git worktrees. Fixes bug 20492; bugfix on 0.2.3.9-alpha. o Minor bugfixes (relay address discovery): - Stop reordering IP addresses returned by the OS. This makes it more likely that Tor will guess the same relay IP address every time. Fixes issue 20163; bugfix on 0.2.7.1-alpha, ticket 17027. Reported by René Mayrhofer, patch by "cypherpunks". o Minor bugfixes (memory allocation): - Change how we allocate memory for large chunks on buffers, to avoid a (currently impossible) integer overflow, and to waste less space when allocating unusually large chunks. Fixes bug 20081; bugfix on 0.2.0.16-alpha. Issue identified by Guido Vranken. o Minor bugfixes (bootstrap): - Remember the directory server we fetched the consensus or previous certificates from, and use it to fetch future authority certificates. This change improves bootstrapping performance. Fixes bug 18963; bugfix on 0.2.8.1-alpha. o Minor bugfixes (circuits): - Make sure extend_info_from_router() is only called on servers. Fixes bug 19639; bugfix on 0.2.8.1-alpha. o Minor bugfixes (client, fascistfirewall): - Avoid spurious warnings when ReachableAddresses or FascistFirewall is set. Fixes bug 20306; bugfix on 0.2.8.2-alpha. o Minor bugfixes (client, unix domain sockets): - Disable IsolateClientAddr when using AF_UNIX backed SocksPorts as the client address is meaningless. Fixes bug 20261; bugfix on 0.2.6.3-alpha. o Minor bugfixes (code style): - Fix an integer signedness conversion issue in the case conversion tables. Fixes bug 19168; bugfix on 0.2.1.11-alpha. o Minor bugfixes (compilation): - Build correctly on versions of libevent2 without support for evutil_secure_rng_add_bytes(). Fixes bug 19904; bugfix on 0.2.5.4-alpha. - When building with Clang, use a full set of GCC warnings. (Previously, we included only a subset, because of the way we detected them.) Fixes bug 19216; bugfix on 0.2.0.1-alpha. - Detect Libevent2 functions correctly on systems that provide libevent2, but where libevent1 is linked with -levent. Fixes bug 19904; bugfix on 0.2.2.24-alpha. Patch from Rubiate. - Run correctly when built on Windows build environments that require _vcsprintf(). Fixes bug 20560; bugfix on 0.2.2.11-alpha. o Minor bugfixes (configuration): - When parsing quoted configuration values from the torrc file, handle Windows line endings correctly. Fixes bug 19167; bugfix on 0.2.0.16-alpha. Patch from "Pingl". o Minor bugfixes (directory authority): - Authorities now sort the "package" lines in their votes, for ease of debugging. (They are already sorted in consensus documents.) Fixes bug 18840; bugfix on 0.2.6.3-alpha. - Die with a more useful error when the operator forgets to place the authority_signing_key file into the keys directory. This avoids an uninformative assert & traceback about having an invalid key. Fixes bug 20065; bugfix on 0.2.0.1-alpha. - When allowing private addresses, mark Exits that only exit to private locations as such. Fixes bug 20064; bugfix on 0.2.2.9-alpha. - When parsing a detached signature, make sure we use the length of the digest algorithm instead of a hardcoded DIGEST256_LEN in order to avoid comparing bytes out-of-bounds with a smaller digest length such as SHA1. Fixes bug 19066; bugfix on 0.2.2.6-alpha. o Minor bugfixes (getpass): - Defensively fix a non-triggerable heap corruption at do_getpass() to protect ourselves from mistakes in the future. Fixes bug 19223; bugfix on 0.2.7.3-rc. Bug found by Guido Vranken, patch by nherring. o Minor bugfixes (guard selection): - Don't mark guards as unreachable if connection_connect() fails. That function fails for local reasons, so it shouldn't reveal anything about the status of the guard. Fixes bug 14334; bugfix on 0.2.3.10-alpha. - Use a single entry guard even if the NumEntryGuards consensus parameter is not provided. Fixes bug 17688; bugfix on 0.2.5.6-alpha. o Minor bugfixes (hidden services): - Increase the minimum number of internal circuits we preemptively build from 2 to 3, so a circuit is available when a client connects to another onion service. Fixes bug 13239; bugfix on 0.1.0.1-rc. - Allow hidden services to run on IPv6 addresses even when the IPv6Exit option is not set. Fixes bug 18357; bugfix on 0.2.4.7-alpha. - Stop logging intro point details to the client log on certain error conditions. Fixed as part of bug 20012; bugfix on 0.2.4.8-alpha. Patch by teor. - When deleting an ephemeral hidden service, close its intro points even if they are not completely open. Fixes bug 18604; bugfix on 0.2.7.1-alpha. - When configuring hidden services, check every hidden service directory's permissions. Previously, we only checked the last hidden service. Fixes bug 20529; bugfix on 0.2.6.2-alpha. o Minor bugfixes (IPv6, testing): - Check for IPv6 correctly on Linux when running test networks. Fixes bug 19905; bugfix on 0.2.7.3-rc; patch by teor. o Minor bugfixes (Linux seccomp2 sandbox): - Add permission to run the sched_yield() and sigaltstack() system calls, in order to support versions of Tor compiled with asan or ubsan code that use these calls. Now "sandbox 1" and "--enable-expensive-hardening" should be compatible on more systems. Fixes bug 20063; bugfix on 0.2.5.1-alpha. o Minor bugfixes (logging): - Downgrade a harmless log message about the pending_entry_connections list from "warn" to "info". Mitigates bug 19926. - Log a more accurate message when we fail to dump a microdescriptor. Fixes bug 17758; bugfix on 0.2.2.8-alpha. Patch from Daniel Pinto. - When logging a directory ownership mismatch, log the owning username correctly. Fixes bug 19578; bugfix on 0.2.2.29-beta. - When we are unable to remove the bw_accounting file, do not warn if the reason we couldn't remove it was that it didn't exist. Fixes bug 19964; bugfix on 0.2.5.4-alpha. Patch from pastly. o Minor bugfixes (memory leak): - Fix a series of slow memory leaks related to parsing torrc files and options. Fixes bug 19466; bugfix on 0.2.1.6-alpha. - Avoid a small memory leak when informing worker threads about rotated onion keys. Fixes bug 20401; bugfix on 0.2.6.3-alpha. - Fix a small memory leak when receiving AF_UNIX connections on a SocksPort. Fixes bug 20716; bugfix on 0.2.6.3-alpha. - When moving a signed descriptor object from a source to an existing destination, free the allocated memory inside that destination object. Fixes bug 20715; bugfix on 0.2.8.3-alpha. - Fix a memory leak and use-after-free error when removing entries from the sandbox's getaddrinfo() cache. Fixes bug 20710; bugfix on 0.2.5.5-alpha. Patch from "cypherpunks". - Fix a small, uncommon memory leak that could occur when reading a truncated ed25519 key file. Fixes bug 18956; bugfix on 0.2.6.1-alpha. o Minor bugfixes (option parsing): - Count unix sockets when counting client listeners (SOCKS, Trans, NATD, and DNS). This has no user-visible behavior changes: these options are set once, and never read. Required for correct behavior in ticket 17178. Fixes bug 19677; bugfix on 0.2.6.3-alpha. Patch by teor. o Minor bugfixes (options): - Check the consistency of UseEntryGuards and EntryNodes more reliably. Fixes bug 20074; bugfix on 0.2.4.12-alpha. Patch by teor. - Stop changing the configured value of UseEntryGuards on authorities and Tor2web clients. Fixes bug 20074; bugfix on commits 51fc6799 in 0.1.1.16-rc and acda1735 in 0.2.4.3-alpha. Patch by teor. o Minor bugfixes (relay): - Ensure relays don't make multiple connections during bootstrap. Fixes bug 20591; bugfix on 0.2.8.1-alpha. - Do not try to parallelize workers more than 16x without the user explicitly configuring us to do so, even if we do detect more than 16 CPU cores. Fixes bug 19968; bugfix on 0.2.3.1-alpha. o Minor bugfixes (testing): - The test-stem and test-network makefile targets now depend only on the tor binary that they are testing. Previously, they depended on "make all". Fixes bug 18240; bugfix on 0.2.8.2-alpha. Based on a patch from "cypherpunks". - Allow clients to retry HSDirs much faster in test networks. Fixes bug 19702; bugfix on 0.2.7.1-alpha. Patch by teor. - Avoid a unit test failure on systems with over 16 detectable CPU cores. Fixes bug 19968; bugfix on 0.2.3.1-alpha. - Let backtrace tests work correctly under AddressSanitizer: disable ASAN's detection of segmentation faults while running test_bt.sh, so that we can make sure that our own backtrace generation code works. Fixes bug 18934; bugfix on 0.2.5.2-alpha. Patch from "cypherpunks". - Fix the test-network-all target on out-of-tree builds by using the correct path to the test driver script. Fixes bug 19421; bugfix on 0.2.7.3-rc. - Stop spurious failures in the local interface address discovery unit tests. Fixes bug 20634; bugfix on 0.2.8.1-alpha; patch by Neel Chauhan. - Use ECDHE ciphers instead of ECDH in tortls tests. LibreSSL has removed the ECDH ciphers which caused the tests to fail on platforms which use it. Fixes bug 20460; bugfix on 0.2.8.1-alpha. - The tor_tls_server_info_callback unit test no longer crashes when debug-level logging is turned on. Fixes bug 20041; bugfix on 0.2.8.1-alpha. o Minor bugfixes (time): - Improve overflow checks in tv_udiff and tv_mdiff. Fixes bug 19483; bugfix on all released tor versions. - When computing the difference between two times in milliseconds, we now round to the nearest millisecond correctly. Previously, we could sometimes round in the wrong direction. Fixes bug 19428; bugfix on 0.2.2.2-alpha. o Minor bugfixes (Tor2web): - Prevent Tor2web clients from running hidden services: these services are not anonymous due to the one-hop client paths. Fixes bug 19678. Patch by teor. o Minor bugfixes (user interface): - Display a more accurate number of suppressed messages in the log rate-limiter. Previously, there was a potential integer overflow in the counter. Now, if the number of messages hits a maximum, the rate-limiter doesn't count any further. Fixes bug 19435; bugfix on 0.2.4.11-alpha. - Fix a typo in the passphrase prompt for the ed25519 identity key. Fixes bug 19503; bugfix on 0.2.7.2-alpha. o Code simplification and refactoring: - Remove redundant declarations of the MIN macro. Closes ticket 18889. - Rename tor_dup_addr() to tor_addr_to_str_dup() to avoid confusion. Closes ticket 18462; patch from "icanhasaccount". - Split the 600-line directory_handle_command_get function into separate functions for different URL types. Closes ticket 16698. o Documentation: - Add module-level internal documentation for 36 C files that previously didn't have a high-level overview. Closes ticket 20385. - Correct the IPv6 syntax in our documentation for the VirtualAddrNetworkIPv6 torrc option. Closes ticket 19743. - Correct the minimum bandwidth value in torrc.sample, and queue a corresponding change for torrc.minimal. Closes ticket 20085. - Fix spelling of "--enable-tor2web-mode" in the manpage. Closes ticket 19153. Patch from "U+039b". - Module-level documentation for several more modules. Closes tickets 19287 and 19290. - Document the --passphrase-fd option in the tor manpage. Fixes bug 19504; bugfix on 0.2.7.3-rc. - Document the default PathsNeededToBuildCircuits value that's used by clients when the directory authorities don't set min_paths_for_circs_pct. Fixes bug 20117; bugfix on 0.2.4.10-alpha. Patch by teor, reported by Jesse V. - Fix manual for the User option: it takes a username, not a UID. Fixes bug 19122; bugfix on 0.0.2pre16 (the first version to have a manpage!). - Fix the description of the --passphrase-fd option in the tor-gencert manpage. The option is used to pass the number of a file descriptor to read the passphrase from, not to read the file descriptor from. Fixes bug 19505; bugfix on 0.2.0.20-alpha. o Removed code: - We no longer include the (dead, deprecated) bufferevent code in Tor. Closes ticket 19450. Based on a patch from "U+039b". o Removed features: - Remove support for "GET /tor/bytes.txt" DirPort request, and "GETINFO dir-usage" controller request, which were only available via a compile-time option in Tor anyway. Feature was added in 0.2.2.1-alpha. Resolves ticket 19035. - There is no longer a compile-time option to disable support for TransPort. (If you don't want TransPort, just don't use it.) Patch from "U+039b". Closes ticket 19449. o Testing: - Run more workqueue tests as part of "make check". These had previously been implemented, but you needed to know special command-line options to enable them. - We now have unit tests for our code to reject zlib "compression bombs". (Fortunately, the code works fine.)

1 0

Tor Browser 6.0.8 is released
by Georg Koppen 13 Dec '16

13 Dec '16

Hi! Tor Browser 6.0.8 is now available from the Tor Project page[1] and also from our distribution directory[2]. This release features important security updates to Firefox[3]. Besides updating Firefox to 45.6.0esr which is fixing important security bugs we ship the latest Tor stable version, 0.2.8.11. HTTPS-Everywhere is updated as well (to 5.2.8) and we make improvements to our default obfs4 bridges. Here is the full changelog since 6.0.7: * All Platforms * Update Firefox to 45.6.0esr * Tor to 0.2.8.11 * Update Torbutton to 1.9.5.13 * Bug 20947: Donation banner improvements * Update HTTPS-Everywhere to 5.2.8 * Bug 20809: Use non-/html search engine URL for DuckDuckGo search plugins * Bug 20837: Activate iat-mode for certain obfs4 bridges * Bug 20838: Uncomment NX01 default obfs4 bridge * Bug 20840: Rotate ports a third time for default obfs4 bridges Georg [1] https://www.torproject.org/download/download-easy.html [2] https://www.torproject.org/dist/torbrowser/6.0.8/ [3] https://www.mozilla.org/en-US/security/advisories/mfsa2016-95/

1 0

Tor 0.2.8.11 is released
by Nick Mathewson 08 Dec '16

08 Dec '16

(If you are about to reply saying "please take me off this list", instead please follow these instructions: https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-announce/ . You will have to enter the actual email address you used to subscribe.) Hi, all! There is a new stable release of the Tor source code, with fixes for a couple of portability issues. If these issues affect you, you should upgrade; otherwise you can safely stay with 0.2.8.10. You can download the source from the usual place on the website. Remember to check the signatures! Packages should be up in a few days. This version of Tor should appear in a stable TorBrowser release around December 14. ================= Changes in version 0.2.8.11 - 2016-12-08 Tor 0.2.8.11 backports fixes for additional portability issues that could prevent Tor from building correctly on OSX Sierra, or with OpenSSL 1.1. Affected users should upgrade; others can safely stay with 0.2.8.10. o Minor bugfixes (portability): - Avoid compilation errors when building on OSX Sierra. Sierra began to support the getentropy() and clock_gettime() APIs, but created a few problems in doing so. Tor 0.2.9 has a more thorough set of workarounds; in 0.2.8, we are just using the /dev/urandom and mach monotonic time interfaces. Fixes bug 20865. Bugfix on 0.2.8.1-alpha. o Minor bugfixes (portability, backport from 0.2.9.5-alpha): - Fix compilation with OpenSSL 1.1 and less commonly-used CPU architectures. Closes ticket 20588.

1 0

Tor 0.2.8.10 is released
by Nick Mathewson 02 Dec '16

02 Dec '16

Hi, all! There is a new stable release of the Tor source code, with fixes for a couple of annoying bugs. (If you are about to reply saying "please take me off this list", instead please follow these instructions: https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-announce/ . You will have to enter the actual email address you used to subscribe.) You can download the source from the usual place on the website. Packages should be up in a few days. This should appear in a stable TorBrowser release around December 14. (There is also a concurrent release of Tor 0.2.9.6-rc; for alpha announcements, please see tor-talk@ or the blog.) ================== Changes in version 0.2.8.10 - 2016-12-02 Tor 0.2.8.10 backports a fix for a bug that would sometimes make clients unusable after they left standby mode. It also backports fixes for a few portability issues and a small but problematic memory leak. o Major bugfixes (client reliability, backport from 0.2.9.5-alpha): - When Tor leaves standby because of a new application request, open circuits as needed to serve that request. Previously, we would potentially wait a very long time. Fixes part of bug 19969; bugfix on 0.2.8.1-alpha. o Major bugfixes (client performance, backport from 0.2.9.5-alpha): - Clients now respond to new application stream requests immediately when they arrive, rather than waiting up to one second before starting to handle them. Fixes part of bug 19969; bugfix on 0.2.8.1-alpha. o Minor bugfixes (portability, backport from 0.2.9.6-rc): - Work around a bug in the OSX 10.12 SDK that would prevent us from successfully targeting earlier versions of OSX. Resolves ticket 20235. o Minor bugfixes (portability, backport from 0.2.9.5-alpha): - Fix implicit conversion warnings under OpenSSL 1.1. Fixes bug 20551; bugfix on 0.2.1.1-alpha. o Minor bugfixes (relay, backport from 0.2.9.5-alpha): - Work around a memory leak in OpenSSL 1.1 when encoding public keys. Fixes bug 20553; bugfix on 0.0.2pre8. o Minor features (geoip): - Update geoip and geoip6 to the November 3 2016 Maxmind GeoLite2 Country database.

1 0

Tor Browser 6.0.7 is released
by Nicolas Vigier 30 Nov '16

30 Nov '16

Tor Browser 6.0.7 is now available from the Tor Browser Project page [1] and also from our distribution directory [2]. 1: https://www.torproject.org/download/download-easy.html 2: https://www.torproject.org/dist/torbrowser/6.0.7/ This release features an important security update to Firefox and contains, in addition to that, an update to NoScript (2.9.5.2). The security flaw responsible for this urgent release is already actively exploited on Windows systems. Even though there is currently, to the best of our knowledge, no similar exploit for OS X or Linux users available the underlying bug affects those platforms as well. Thus we strongly recommend that all users apply the update to their Tor Browser immediately. A restart is required for it to take effect. Tor Browser users who had set their security slider to "High" are believed to have been safe from this vulnerability. We will have alpha and hardened Tor Browser updates out shortly. In the meantime, users of these series can mitigate the security flaw in at least two ways: 1) Set the security slider to "High" as this is preventing the exploit from working. 2) Switch to the stable series until updates for alpha and hardened are available, too. Here is the full changelog since 6.0.6: * All Platforms * Update Firefox to 45.5.1esr * Update NoScript to 2.9.5.2

1 0

Tor Browser 6.0.6 is released
by Nicolas Vigier 15 Nov '16

15 Nov '16

Tor Browser 6.0.6 is now available from the Tor Browser Project page [1] and also from our distribution directory [2]. 1: https://www.torproject.org/download/download-easy.html 2: https://www.torproject.org/dist/torbrowser/6.0.6/ This release features important security updates [3] to Firefox. 3: https://www.mozilla.org/en-US/security/advisories/mfsa2016-90/ This release is updating Firefox to 45.5.0esr. Moreover, other components got an update as well: Tor to 0.2.8.9, HTTPS-Everywhere to 5.2.7, and OpenSSL to 1.0.1u. We fixed a lot of usability bugs, some caused by Apple's macOS Sierra (meek did not work anymore and windows could not be dragged either). We moved directly to DuckDuckGo as our search engine avoiding a roundtrip to Disconnect.me first. Finally, we added a donation banner shown in some localized bundles starting on Nov 23 in order to point to our end-of-the-year 2016 donation campaign. Here is the full changelog since 6.0.5: * All Platforms * Update Firefox to 45.5.0esr * Update Tor to 0.2.8.9 * Update OpenSSL to 1.0.1u * Update Torbutton to 1.9.5.12 * Bug 20414: Add donation banner on about:tor for 2016 campaign * Translation updates * Update Tor Launcher to 0.2.9.4 * Bug 20429: Do not open progress window if tor doesn't get started * Bug 19646: Wrong location for meek browser profile on OS X * Update HTTPS-Everywhere to 5.2.7 * Update meek to 0.25 * Bug 19646: Wrong location for meek browser profile on OS X * Bug 20030: Shut down meek-http-helper cleanly if built with Go > 1.5.4 * Bug 19838: Add dgoulet's bridge and add another one commented out * Bug 20296: Rotate ports again for default obfs4 bridges * Bug 19735: Switch default search engine to DuckDuckGo * Bug 20118: Don't unpack HTTPS Everywhere anymore * Windows * Bug 20342: Add tor-gencert.exe to expert bundle * OS X * Bug 20204: Windows don't drag on macOS Sierra anymore * Bug 20250: Meek fails on macOS Sierra if built with Go < 1.7 * Build system * All platforms * Bug 20023: Upgrade Go to 1.7.3

1 0

← Newer
1
...
22
23
24
25
26
27
28
29
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-announce