Skip to content

CVE-2012-2249

Tor before 0.2.3.23-rc allows remote attackers to cause a denial of service (assertion failure...

5.0 MediumFix available

CVE-2012-2249 is a medium vulnerability (CVSS 5.0) in Torproject Tor, published February 3, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.29%, the 70th percentile. Fixed in tor 0.2.3.23-rc-1.

Tor before 0.2.3.23-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a renegotiation attempt that occurs after the initiation of the V3 link protocol.

Exploit likelihood

1.29%Up 0.2 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Tor before 0.2.3.23-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a renegotiation attempt that occurs after the initiation of the V3 link protocol.

Record: CVE-2012-2249
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated: 2026-11-02

CVE List No score

Tor before 0.2.3.23-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a renegotiation attempt that occurs after the initiation of the V3 link protocol.

Record: CVE-2012-2249
Updated: 2026-11-02

EUVDEUVD-2012-2242 No score

Tor before 0.2.3.23-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a renegotiation attempt that occurs after the initiation of the V3 link protocol.

Record: EUVD-2012-2242
Updated: 2026-11-03

GitHub AdvisoriesGHSA-h977-vhf7-vm3w No score

Tor before 0.2.3.23-rc allows remote attackers to cause a denial of service (assertion failure...

Tor before 0.2.3.23-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a renegotiation attempt that occurs after the initiation of the V3 link protocol.

Record: GHSA-h977-vhf7-vm3w
Updated: 2026-11-02

OSV No score

Tor before 0.2.3.23-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a renegotiation attempt that occurs after the initiation of the V3 link protocol.

Record: CVE-2012-2249
Updated: 2026-11-02

OSVDEBIAN-CVE-2012-2249 No score

Tor before 0.2.3.23-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a renegotiation attempt that occurs after the initiation of the V3 link protocol.

Record: DEBIAN-CVE-2012-2249
Updated: 2026-11-02

Affected products

torproject tor

Affected packages

Affected packages
Package	Affected	Fixed
`tor` Debian:12	before 0.2.3.23-rc-1	0.2.3.23-rc-1
`tor` Debian:13	before 0.2.3.23-rc-1	0.2.3.23-rc-1
`tor` Debian:14	before 0.2.3.23-rc-1	0.2.3.23-rc-1
`tor` Debian:6.0	before 0.2.4.23-1~deb6u1, plus listed versions 0.2.1.29-10.2.1.30-10.2.1.31-10.2.1.31-1~lenny+10.2.1.32-1 Show 45 moreShow less 0.2.2.1-alpha-10.2.2.10-alpha-10.2.2.10-alpha-20.2.2.11-alpha-10.2.2.12-alpha-10.2.2.13-alpha-10.2.2.14-alpha-10.2.2.15-alpha-10.2.2.16-alpha-10.2.2.17-alpha-10.2.2.18-alpha-10.2.2.18-alpha-20.2.2.19-alpha-10.2.2.2-alpha-10.2.2.20-alpha-10.2.2.21-alpha-10.2.2.22-alpha-10.2.2.23-alpha-10.2.2.27-beta-10.2.2.28-beta-10.2.2.29-beta-10.2.2.3-alpha-10.2.2.30-rc-10.2.2.31-rc-10.2.2.32-10.2.2.32-1~bpo60+10.2.2.33-10.2.2.33-1~bpo60+10.2.2.34-10.2.2.34-1~bpo60+10.2.2.35-10.2.2.35-1~squeeze+10.2.2.36-10.2.2.37-10.2.2.37-1~bpo60+10.2.2.37-1~squeeze+10.2.2.38-10.2.2.39-10.2.2.4-alpha-10.2.2.5-alpha-10.2.2.6-alpha-10.2.2.7-alpha-10.2.2.7-alpha-20.2.2.8-alpha-10.2.2.9-alpha-1	0.2.4.23-1~deb6u1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

This page doesn't list everything

Left out here: 50 versions. The JSON record has them.