[tor-announce] Tor is released

Roger Dingledine arma at mit.edu
Sun Aug 19 06:18:32 UTC 2012

Tor fixes a rare race condition that can crash exit relays;
fixes a remotely triggerable crash bug; and fixes a timing attack that
could in theory leak path information.


Changes in version - 2012-08-12
  o Security fixes:
    - Avoid read-from-freed-memory and double-free bugs that could occur
      when a DNS request fails while launching it. Fixes bug 6480;
      bugfix on
    - Avoid an uninitialized memory read when reading a vote or consensus
      document that has an unrecognized flavor name. This read could
      lead to a remote crash bug. Fixes bug 6530; bugfix on
    - Try to leak less information about what relays a client is
      choosing to a side-channel attacker. Previously, a Tor client would
      stop iterating through the list of available relays as soon as it
      had chosen one, thus finishing a little earlier when it picked
      a router earlier in the list. If an attacker can recover this
      timing information (nontrivial but not proven to be impossible),
      they could learn some coarse-grained information about which relays
      a client was picking (middle nodes in particular are likelier to
      be affected than exits). The timing attack might be mitigated by
      other factors (see bug 6537 for some discussion), but it's best
      not to take chances. Fixes bug 6537; bugfix on 0.0.8rc1.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 190 bytes
Desc: Digital signature
URL: <http://lists.torproject.org/pipermail/tor-announce/attachments/20120819/282ed6ee/attachment.pgp>

More information about the tor-announce mailing list