Update Info

openSUSE-2026-164


Security update for tor


Type: security
Severity: critical
Issued: 2026-05-12
Description:
This update for tor fixes the following issues:

- Update to 0.4.9.8
  * Fix out-of-bounds read (boo#1264341, CVE-2026-44597, TROVE-2026-011)
  * Do not attempt or accept BEGIN_DIR via conflux legs
    (boo#1264342, CVE-2026-44599,TROVE-2026-008)
  * Adjust conflux out-of-order queue accounting when clearing a queue
    (boo#1264343, CVE-2026-44600, TROVE-2026-010)
  * Fix a client-side crash caused by double-close of a circuit while
    under circuit queue memory pressure
    (boo#1264344, CVE-2026-44601, TROVE-2026-009)
  * Fix null pointer dereference when receiving a CERT cell out of
    order (boo#1264345, CVE-2026-44602, TROVE-2026-006)
  * Fix off-by-one out-of-bounds read if a malformed BEGIN cell is
    received (boo#1264346, CVE-2026-44603, TROVE-2026-007)

- upate to 0.4.9.5:
  * first stable release in the 0.4.9 series
  * introduces a new circuit-level encryption design for better
    client security
  * introduce a more scalable way for large relay operators to
    annotate which relays they run so clients can avoid using too
    many of them in a single circuit


              

Packages


  • tor-0.4.9.8-bp157.2.9.1