Publishing details

Changelog

tor (0.2.4.27-1build0.14.04.1) trusty-security; urgency=medium

  * Synced from Debian as a security update

tor (0.2.4.27-1) wheezy-security; urgency=medium

  * New upstream version, fixing hidden service related Denial of
    Service bugs:
    - Fix two remotely triggerable assertion failures (upstream bugs
      #15600 and #15601).
    - Disallow multiple INTRODUCE1 cells on the same circuit at introduction
      points, making overwhelming hidden services with introductions more
      expensive (upstream bug #15515).

tor (0.2.4.26-1) wheezy-security; urgency=medium

  * New upstream version.
    + Fixes the following security relevant issues (copied from upstream
      changelog):
      - Fix an assertion failure that could occur under high DNS load.
        Fixes bug 14129; bugfix on Tor 0.0.7rc1. Found by "jowr";
        diagnosed and fixed by "cypherpunks".
      - Fix a bug that could lead to a relay crashing with an assertion
        failure if a buffer of exactly the wrong layout was passed to
        buf_pullup() at exactly the wrong time. Fixes bug 15083; bugfix on
        0.2.0.10-alpha. Patch from 'cypherpunks'.
      - Do not assert if the 'data' pointer on a buffer is advanced to the
        very end of the buffer; log a BUG message instead. Only assert if
        it is past that point. Fixes bug 15083; bugfix on 0.2.0.10-alpha.
      - Disable support for SSLv3. All versions of OpenSSL in use with Tor
        today support TLS 1.0 or later, so we can safely turn off support
        for this old (and insecure) protocol. Fixes bug 13426.
    + Updates the list of directory authorities and the geoIP database.

tor (0.2.4.24-1) wheezy; urgency=low

  * New upstream version, built for stable (re: #762587):
    - Use correct byte order when sending the address of the chosen rendezvous
      point to a hidden service.  This bug meant that clients were leaking to
      the hidden service whether they were on a little-endian (common) or
      big-endian (rare) system.
    - Change IP address for the gabelmoo v3 directory authority.
    - Update geoip and geoip6 to the August 7 2014 Maxmind GeoLite2
      Country database.

tor (0.2.4.23-1~deb7u1) wheezy-security; urgency=high

  * New upstream version, built for wheezy:
    - Clients will no longer use CREATE_FAST cells for the first hop of their
      circuit.  This approach can improve security on connections where Tor's
      circuit handshake is stronger than the available TLS connection security
      levels.
    - Prepare for lowering the number of used entry guards by honoring the
      NumDirectoryGuards consensus parameter.
    - Fix a bug in the bounds-checking in the 32-bit curve25519-donna
      implementation.
    - Warn and drop the circuit if we receive an inbound 'relay early' cell.

tor (0.2.4.22-1~deb7u1) wheezy; urgency=medium

  * Build for stable (re: #751977).
  * Revert upstream changes to the default torrc to match what 0.2.3.25-1
    from stable has (two minor changes in comments).

tor (0.2.4.22-1) unstable; urgency=medium

  * New upstream version.

tor (0.2.4.21-1) unstable; urgency=low

  * New upstream version.

 -- Marc Deslauriers <email address hidden>  Wed, 29 Jul 2015 07:57:22 -0400

Available diffs

Builds

Package files