Bug 1204773 (CVE-2015-2688, CVE-2015-2689)

Summary: CVE-2015-2688 CVE-2015-2689 tor: security fixes in 0.2.4.26 and 0.2.5.11
Product: [Other] Security Response Reporter: Martin Prpič <mprpic>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: carnil, jamielinux, pfrields, pwouters, s, vkaigoro
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: tor 0.2.4.26, tor 0.2.5.11 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-03-03 14:32:10 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1204774, 1204775    
Bug Blocks:    

Description Martin Prpič 2015-03-23 13:26:09 UTC
Several security-related fixes have been included in the 0.2.4.26 and 0.2.5.11 releases of tor:

https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html

Comment 1 Martin Prpič 2015-03-23 13:27:40 UTC
Created tor tracking bugs for this issue:

Affects: fedora-all [bug 1204774]
Affects: epel-all [bug 1204775]

Comment 2 Jamie Nguyen 2015-03-24 15:57:54 UTC
*** Bug 1205237 has been marked as a duplicate of this bug. ***

Comment 3 Vasyl Kaigorodov 2015-03-25 13:27:53 UTC
CVE-2015-2688 CVE-2015-2689 were assigned to these issues: 
http://seclists.org/oss-sec/2015/q1/1001

Comment 4 Fedora Update System 2015-04-05 14:31:25 UTC
tor-0.2.5.11-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2015-04-05 14:35:33 UTC
tor-0.2.5.11-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2015-04-10 19:15:11 UTC
tor-0.2.5.11-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2015-04-10 19:15:32 UTC
tor-0.2.4.26-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2015-04-21 18:39:44 UTC
tor-0.2.5.12-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2015-04-28 19:15:32 UTC
tor-0.2.5.12-1.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2015-04-28 19:15:50 UTC
tor-0.2.5.12-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.