CVE-2015-2688
buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected...
buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.
- Record
CVE-2015-2688- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-755
- Updated
- 2026-11-02
CVE List No score
buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.
- Record
CVE-2015-2688- Updated
- 2026-11-02
EUVDEUVD-2015-2778 No score
buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.
- Record
EUVD-2015-2778- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9h72-qxgr-5j87 No score
buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected...
buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.
- Record
GHSA-9h72-qxgr-5j87- Updated
- 2026-11-02
OSV
buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.
- Record
CVE-2015-2688- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-2688
buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.
- Record
DEBIAN-CVE-2015-2688- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-2688
buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.
- Record
UBUNTU-CVE-2015-2688- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10423-1 No score
tor-0.2.8.11-1.1 on GA media
These are all security issues fixed in the tor-0.2.8.11-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10423-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
torDebian:12 |
before 0.2.5.11-1 | 0.2.5.11-1 |
torDebian:13 |
before 0.2.5.11-1 | 0.2.5.11-1 |
torDebian:14 |
before 0.2.5.11-1 | 0.2.5.11-1 |
torDebian:6.0 From an advisory covering 2 CVEs |
before 0.2.4.26-1~deb6u1, plus listed versions 0.2.1.29-10.2.1.30-10.2.1.31-10.2.1.31-1~lenny+10.2.1.32-1 Show 45 moreShow less0.2.2.1-alpha-10.2.2.10-alpha-10.2.2.10-alpha-20.2.2.11-alpha-10.2.2.12-alpha-10.2.2.13-alpha-10.2.2.14-alpha-10.2.2.15-alpha-10.2.2.16-alpha-10.2.2.17-alpha-10.2.2.18-alpha-10.2.2.18-alpha-20.2.2.19-alpha-10.2.2.2-alpha-10.2.2.20-alpha-10.2.2.21-alpha-10.2.2.22-alpha-10.2.2.23-alpha-10.2.2.27-beta-10.2.2.28-beta-10.2.2.29-beta-10.2.2.3-alpha-10.2.2.30-rc-10.2.2.31-rc-10.2.2.32-10.2.2.32-1~bpo60+10.2.2.33-10.2.2.33-1~bpo60+10.2.2.34-10.2.2.34-1~bpo60+10.2.2.35-10.2.2.35-1~squeeze+10.2.2.36-10.2.2.37-10.2.2.37-1~bpo60+10.2.2.37-1~squeeze+10.2.2.38-10.2.2.39-10.2.2.4-alpha-10.2.2.5-alpha-10.2.2.6-alpha-10.2.2.7-alpha-10.2.2.7-alpha-20.2.2.8-alpha-10.2.2.9-alpha-1 |
0.2.4.26-1~deb6u1 |
torDebian:7 From an advisory covering 2 CVEs |
before 0.2.4.26-1, plus listed versions 0.2.3.25-10.2.4.1-alpha-10.2.4.10-alpha-10.2.4.11-alpha-10.2.4.12-alpha-1 Show 25 moreShow less0.2.4.12-alpha-20.2.4.13-alpha-10.2.4.14-alpha-10.2.4.15-rc-10.2.4.16-rc-10.2.4.17-rc-10.2.4.18-rc-10.2.4.19-10.2.4.2-alpha-10.2.4.20-10.2.4.21-10.2.4.22-10.2.4.22-1~bpo70+10.2.4.22-1~deb7u10.2.4.23-10.2.4.23-1~deb6u10.2.4.23-1~deb7u10.2.4.24-10.2.4.26-1~deb6u10.2.4.3-alpha-10.2.4.4-alpha-10.2.4.5-alpha-10.2.4.6-alpha-10.2.4.7-alpha-10.2.4.9-alpha-1 |
0.2.4.26-1 |
torUbuntu:14.04:LTS |
before 0.2.4.27-1build0.14.04.1, plus listed versions 0.2.3.25-10.2.4.19-10.2.4.20-1 |
0.2.4.27-1build0.14.04.1 |
toropenSUSE:Tumbleweed From an advisory covering 22 CVEs |
before 0.2.8.11-1.1 | 0.2.8.11-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-2688 is a high vulnerability (CVSS 7.5) in The Tor Project Tor, published March 22, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.19%, the 82nd percentile. Fixed in tor 0.2.5.11-1.
References
lists.torproject.org/pipermail/tor-talk/2015-March/037281.html
trac.torproject.org/projects/tor/ticket/15083
nvd.nist.gov/vuln/detail/CVE-2015-2688
github.com/advisories/GHSA-9h72-qxgr-5j87
security-tracker.debian.org/tracker/CVE-2015-2688
ubuntu.com/security/CVE-2015-2688
Show 23 moreShow less
cve.org/CVERecord?id=CVE-2015-2688
suse.com/security/cve/CVE-2011-0427
Left out here: 54 versions. The JSON record has them.