{"id":"CVE-2020-15572","aliases":["DEBIAN-CVE-2020-15572","EUVD-2020-7559","GHSA-cfp9-244f-h66c","openSUSE-SU-2020:1970-1","openSUSE-SU-2024:11469-1"],"status":"published","title":"Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service ...","description":"Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01404,"percentile":0.72943,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-125"],"published":"2020-07-15T16:02:10Z","modified":"2026-10-26T12:00:42Z","fixes":[{"ecosystem":"Debian:12","package":"tor","fixed_in":["0.4.3.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tor","fixed_in":["0.4.3.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tor","fixed_in":["0.4.3.6-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3.6-1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4.6-bp152.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4.6-bp152.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4.6-bp152.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4.6-bp152.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4.6-bp152.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.6.7-2.2"}]}],"bundled":22}],"products":[{"vendor":"torproject","product":"tor"}],"references":[{"url":"https://gitlab.torproject.org/tpo/core/tor/-/issues/33119","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://trac.torproject.org/projects/tor/wiki/TROVE","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://blog.torproject.org/new-release-tor-03511-0428-0436-security-fixes","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15572"},{"url":"https://github.com/advisories/GHSA-cfp9-244f-h66c"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-15572","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LICIVWVPYBVUILMW5J4DEG6B67OGC45P/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1164275","tags":["report"]},{"url":"https://bugzilla.suse.com/1167013","tags":["report"]},{"url":"https://bugzilla.suse.com/1167014","tags":["report"]},{"url":"https://bugzilla.suse.com/1173979","tags":["report"]},{"url":"https://bugzilla.suse.com/1178741","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15572","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38385","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-15572","description":"Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001.","status":"published","published":"2020-07-15T16:02:10Z","modified":"2024-08-04T13:22:29.209Z","updated_at":"2026-11-02T14:35:50.545879Z"}],"euvd":[{"id":"EUVD-2020-7559","description":"Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001.","status":"published","published":"2020-07-15T16:02:10Z","modified":"2024-08-04T13:22:29Z","updated_at":"2026-11-03T03:07:30.980066Z"}],"ghsa":[{"id":"GHSA-cfp9-244f-h66c","title":"Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service ...","description":"Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001.","status":"published","published":"2022-05-24T17:23:37Z","modified":"2023-01-29T05:03:52Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:45:24.688971Z"}],"nvd":[{"id":"CVE-2020-15572","description":"Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001.","status":"published","published":"2020-07-15T17:15:11.283Z","modified":"2026-06-17T02:56:50.467Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:06:09.126752Z"}],"osv":[{"id":"CVE-2020-15572","description":"Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001.","status":"published","published":"2020-07-15T17:15:11.283Z","modified":"2026-10-24T10:50:10.712034596Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"DEBIAN-CVE-2020-15572","description":"Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001.","status":"published","published":"2020-07-15T17:15:11.283Z","modified":"2026-10-26T12:00:42.622949981Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"openSUSE-SU-2020:1970-1","title":"Security update for tor","description":"This update for tor fixes the following issues:\n\nUpdating tor to a newer version in the respective codestream.\n\n- tor 0.3.5.12:\n  * Check channels+circuits on relays more thoroughly (TROVE-2020-005, boo#1178741)\n  * Not affected by out-of-bound memory access (CVE-2020-15572, boo#1173979)\n  * Fix DoS defenses on bridges with a pluggable transport\n  * CVE-2020-10592: CPU consumption DoS and timing patterns (boo#1167013)\n  * CVE-2020-10593: circuit padding memory leak (boo#1167014) \n\n- tor 0.4.4.6\n  * Check channels+circuits on relays more thoroughly (TROVE-2020-005, boo#1178741)\n  * Fix a crash due to an out-of-bound memory access (CVE-2020-15572, boo#1173979)\n  * Fix logrotate to not fail when tor is stopped (boo#1164275)\n","status":"published","published":"2020-11-19T15:25:33Z","modified":"2026-02-04T03:52:07.616472Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:11469-1","title":"tor-0.4.6.7-2.2 on GA media","description":"These are all security issues fixed in the tor-0.4.6.7-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:58:38.644616Z","updated_at":"2026-11-02T16:58:35.195147Z"}]}}