Improper input validation in Torproject Tor
CVE-2012-4922
The tor_timegm function in common/util.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.22-rc, does not properly validate time values, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a m…
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.042 (89.0th percentile) — read the EPSS interpretation.
Affected products
- Torproject Tor — versions 0.0.2, 0.0.3, 0.0.4
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- GLSA-201301-03 (vendor-advisory, x_refsource_GENTOO)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (x_refsource_CONFIRM)
- [oss-security] 20120912 CVE id request: tor (mailing-list, x_refsource_MLIST)
- FEDORA-2012-14638 (x_refsource_FEDORA, vendor-advisory)
- cve@mitre.org (x_refsource_CONFIRM)
- [tor-talk] 20120912 Tor 0.2.3.22-rc is out (mailing-list, x_refsource_MLIST)
- openSUSE-SU-2012:1278 (vendor-advisory, x_refsource_SUSE)
Frequently asked questions
- What is CVE-2012-4922?
- CVE-2012-4922 is a vulnerability in Torproject Tor, classified under Improper Input Validation. Published 2012-09-14.
- Is CVE-2012-4922 known to be exploited?
- 8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.