CVE-2015-2929
The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12,...
CVE-2015-2929 is a high vulnerability (CVSS 7.5) in The Tor Project Tor, published April 6, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.16%, the 67th percentile. Fixed in tor 0.2.5.12-1.
The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and application exit) via a malformed HS descriptor.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and application exit) via a malformed HS descriptor.
- Record
CVE-2015-2929- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and application exit) via a malformed HS descriptor.
- Record
CVE-2015-2929- Updated
- 2026-11-02
EUVDEUVD-2015-3014 No score
The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and application exit) via a malformed HS descriptor.
- Record
EUVD-2015-3014- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f7jp-x5vp-978r No score
The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12,...
The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and application exit) via a malformed HS descriptor.
- Record
GHSA-f7jp-x5vp-978r- Updated
- 2026-11-02
OSV
The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and application exit) via a malformed HS descriptor.
- Record
CVE-2015-2929- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-2929
The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and application exit) via a malformed HS descriptor.
- Record
DEBIAN-CVE-2015-2929- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-2929
The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and application exit) via a malformed HS descriptor.
- Record
UBUNTU-CVE-2015-2929- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2015-0151 No score
Updated tor packages fix security vulnerabilities
"disgleirio" discovered that a malicious client could trigger an assertion failure in a Tor instance providing a hidden service, thus rendering the service inaccessible (CVE-2015-2928).
"DonnchaC" discovered that Tor clients would crash with an assertion failure upon parsing specially crafted hidden service descriptors (CVE-2015-2929).
Introduction points would accept multiple INTRODUCE1 cells on one circuit, making it inexpensive for an attacker to overload a hidden service with introductions. Introduction points now no longer allow multiple cells of that type on the same circuit.
The tor package has been updated to version 0.2.4.27, fixing these issues.
- Record
MGASA-2015-0151- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10423-1 No score
tor-0.2.8.11-1.1 on GA media
These are all security issues fixed in the tor-0.2.8.11-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10423-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
torDebian:12 |
before 0.2.5.12-1 | 0.2.5.12-1 |
torDebian:13 |
before 0.2.5.12-1 | 0.2.5.12-1 |
torDebian:14 |
before 0.2.5.12-1 | 0.2.5.12-1 |
torDebian:6.0 |
before 0.2.4.27-1~deb6u1, plus listed versions 0.2.1.29-10.2.1.30-10.2.1.31-10.2.1.31-1~lenny+10.2.1.32-1 Show 45 moreShow less0.2.2.1-alpha-10.2.2.10-alpha-10.2.2.10-alpha-20.2.2.11-alpha-10.2.2.12-alpha-10.2.2.13-alpha-10.2.2.14-alpha-10.2.2.15-alpha-10.2.2.16-alpha-10.2.2.17-alpha-10.2.2.18-alpha-10.2.2.18-alpha-20.2.2.19-alpha-10.2.2.2-alpha-10.2.2.20-alpha-10.2.2.21-alpha-10.2.2.22-alpha-10.2.2.23-alpha-10.2.2.27-beta-10.2.2.28-beta-10.2.2.29-beta-10.2.2.3-alpha-10.2.2.30-rc-10.2.2.31-rc-10.2.2.32-10.2.2.32-1~bpo60+10.2.2.33-10.2.2.33-1~bpo60+10.2.2.34-10.2.2.34-1~bpo60+10.2.2.35-10.2.2.35-1~squeeze+10.2.2.36-10.2.2.37-10.2.2.37-1~bpo60+10.2.2.37-1~squeeze+10.2.2.38-10.2.2.39-10.2.2.4-alpha-10.2.2.5-alpha-10.2.2.6-alpha-10.2.2.7-alpha-10.2.2.7-alpha-20.2.2.8-alpha-10.2.2.9-alpha-1 |
0.2.4.27-1~deb6u1 |
torDebian:7 |
before 0.2.4.27-1, plus listed versions 0.2.3.25-10.2.4.1-alpha-10.2.4.10-alpha-10.2.4.11-alpha-10.2.4.12-alpha-1 Show 27 moreShow less0.2.4.12-alpha-20.2.4.13-alpha-10.2.4.14-alpha-10.2.4.15-rc-10.2.4.16-rc-10.2.4.17-rc-10.2.4.18-rc-10.2.4.19-10.2.4.2-alpha-10.2.4.20-10.2.4.21-10.2.4.22-10.2.4.22-1~bpo70+10.2.4.22-1~deb7u10.2.4.23-10.2.4.23-1~deb6u10.2.4.23-1~deb7u10.2.4.24-10.2.4.26-10.2.4.26-1~deb6u10.2.4.27-1~deb6u10.2.4.3-alpha-10.2.4.4-alpha-10.2.4.5-alpha-10.2.4.6-alpha-10.2.4.7-alpha-10.2.4.9-alpha-1 |
0.2.4.27-1 |
torMageia:4 |
before 0.2.4.27-1.mga4 | 0.2.4.27-1.mga4 |
torUbuntu:14.04:LTS |
before 0.2.4.27-1build0.14.04.1, plus listed versions 0.2.3.25-10.2.4.19-10.2.4.20-1 |
0.2.4.27-1build0.14.04.1 |
toropenSUSE:Tumbleweed |
before 0.2.8.11-1.1 | 0.2.8.11-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
openwall.com/lists/oss-security/2015/04/06/5
trac.torproject.org/projects/tor/ticket/15601
nvd.nist.gov/vuln/detail/CVE-2015-2929
github.com/advisories/GHSA-f7jp-x5vp-978r
security-tracker.debian.org/tracker/CVE-2015-2929
advisories.mageia.org/MGASA-2015-0151.html
Show 27 moreShow less
bugs.mageia.org/show_bug.cgi?id=15639
blog.torproject.org/blog/tor-02512-and-0267-are-released
debian.org/security/2015/dsa-3216
ubuntu.com/security/CVE-2015-2929
cve.org/CVERecord?id=CVE-2015-2929
suse.com/security/cve/CVE-2011-0427
Left out here: 56 versions. The JSON record has them.