Low WID-SEC-2026-1398 6 CVEs

Tor: Mehrere Schwachstellen

Published May 6, 2026 · Updated May 12, 2026 · Revision 3 · de-DE

Vendor: Debian Vendor: SUSE Product: Linux Product: openSUSE Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Tor ausnutzen, um einen Denial of Service Angriff durchzuführen oder Daten zu manipulieren.

Product

Tor ist eine Anwendung bzw. Netzwerk zur Anonymisierung der Verbindungsdaten.

Vulnerabilities 6

Low 3.7

CVE-2026-44597

Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload…

torproject Tor tor tor Debian Ubuntu

May 7, 2026
Low 3.7

CVE-2026-44599

Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.

torproject Tor tor tor Debian Ubuntu

May 7, 2026
Low 3.7

CVE-2026-44600

Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-20…

torproject Tor tor tor Debian Ubuntu

May 7, 2026
Low 3.7

CVE-2026-44601

Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close …

torproject Tor tor tor Debian Ubuntu

May 7, 2026
Low 3.7

CVE-2026-44602

Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006.

torproject Tor tor tor Debian Ubuntu

May 7, 2026
Low 3.7

CVE-2026-44603

Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007.

torproject Tor tor tor Debian Ubuntu

May 7, 2026

Revision history

2026-05-12 #3
Neue Updates von openSUSE aufgenommen
2026-05-10 #2
Neue Updates von Debian und openSUSE aufgenommen
2026-05-06 #1
Initiale Fassung

References

EU Vulnerability Database vom 2026-05-06
https://euvd.enisa.europa.eu/enisa/EUVD-2026-28231
EU Vulnerability Database vom 2026-05-06
https://euvd.enisa.europa.eu/enisa/EUVD-2026-28237
EU Vulnerability Database vom 2026-05-06
https://euvd.enisa.europa.eu/enisa/EUVD-2026-28302
EU Vulnerability Database vom 2026-05-06
https://euvd.enisa.europa.eu/enisa/EUVD-2026-28304
EU Vulnerability Database vom 2026-05-06
https://euvd.enisa.europa.eu/enisa/EUVD-2026-28306
EU Vulnerability Database vom 2026-05-06
https://euvd.enisa.europa.eu/enisa/EUVD-2026-28238
Debian Security Advisory DSA-6260 vom 2026-05-10
https://lists.debian.org/debian-security-announce/2026/msg00171.html
openSUSE Security Update OPENSUSE-SU-2026:20709-1 vom 2026-05-10
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7CA5EVBGTZS4CX75WGJ22XJWHYYBH5RP/
openSUSE Security Update OPENSUSE-SU-2026:0164-1 vom 2026-05-13
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VQX4DA3LR3ZCBNECDPXURLIJIBDHWYOC/