CVE-2018-0491
high · 7.5A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to cause a denial of service (relay crash) because the KIST implementation allows a channel to be added more than once in the pending list.
7.5
CVSS
14.8%
EPSS (exploit prob.)
97th
EPSS percentile
2018-03-05
Published
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-416
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| torproject | tor | >= 0.3.2.0, < 0.3.2.10 |
Check a specific version with /api/v1/cve/match.
References
- https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915
- https://trac.torproject.org/projects/tor/ticket/24700
- https://trac.torproject.org/projects/tor/ticket/25117
- https://www.exploit-db.com/exploits/44994/
- https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915
- https://trac.torproject.org/projects/tor/ticket/24700
- https://trac.torproject.org/projects/tor/ticket/25117
- https://www.exploit-db.com/exploits/44994/
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2018-0491