CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

security/tor0.4.9.14

Anonymizing overlay network for TCP

1
unaddressed
0
VuXML only, still affected
21
fixed
Maintainer
yuri@FreeBSD.org
Packages
tor 0.4.9.14
Upstream
up to date
CPE
torproject:tor from the port
WWW
https://www.torproject.org/
Links
cgit · VuXML

Unaddressed (1) · The CVE record lists this version as affected, no VuXML entry names the CVE

CVE-2017-165416.52017-11-04Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a cra…

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (21)

Show 21 fixed
VuXML entries whose affected range this version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVE-2026-776388.92026-08-20Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that th…
CVE-2026-776427.52026-08-20tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most T…
CVE-2026-775847.02026-08-20Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN …
CVE-2026-776416.52026-08-20tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_from_edge() was ignored, so a …
CVE-2026-775875.92026-08-20Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has alre…
CVE-2026-776395.32026-08-20Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection thr…
CVE-2026-776403.72026-08-20tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches Z_STREAM_END, causing zl…

Commits (239)

Mathieu Arnold (mat) · 0.4.5.7
all: Remove all other $FreeBSD keywords.
135fdeebb9
Mathieu Arnold (mat) · 0.4.5.7
Remove # $FreeBSD$ from Makefiles.
305f148f48
Yuri Victorovich (yuri) · 0.4.5.7
security/tor: Update 0.4.5.6 -> 0.4.5.7

Changelog: https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.4.5.7 (security release)

Reported by:	upstream notification
88271f7824
Yuri Victorovich (yuri) · 0.4.5.6
security/tor: Update 0.4.4.7 -> 0.4.5.6

Changelog: https://lists.torproject.org/pipermail/tor-announce/2021-February/000214.html
- contains major and minor bugfixes and new features.

Port options LTTNG,USDT,LOG_DEBUG backported from security/tor-devel.
LIB_DEPENDS is fixes in STATIC_TOR option.

Reported by:	upstream notification
1387321eaa
Yuri Victorovich (yuri) · 0.4.4.7
security/tor: Fix build with LibreSSL 3.2

PR:		253486
Submitted by:	brnrd
e3e9ed48e9
Yuri Victorovich (yuri) · 0.4.4.7
security/tor: Update 0.4.4.6 -> 0.4.4.7

Reported by:	upstream notification
f9d6bde544
Yuri Victorovich (yuri) · 0.4.4.6_1
security/tor: Allow _tor group to read tor files and directories under /var

PR:		252127
Requested by:	Dries Michiels <driesm.michiels@gmail.com>
f223aaed3c
Yuri Victorovich (yuri) · 0.4.4.6
secirity/tor & secirity/tor-devel: Broken with libressl.

Reported by:	cubox@cubox.dev
cf6a625b8c
Yuri Victorovich (yuri) · 0.4.4.6
security/tor: Update 0.4.4.5 -> 0.4.4.6

Changelog: https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.4.4.6

Reported by:	Upstream notification
MFH:		2020Q4 (major and minor bugfixes)
dea18ee6a2
Yuri Victorovich (yuri) · 0.4.4.5
security/tor: Fix build when both TCMALLOC=yes and STATIC_TOR=yes

Also:
* Remove unnecessary REINPLACE_CMD-patching commands
* Simplify CONFLICTS_INSTALL
756a51829f
Yuri Victorovich (yuri) · 0.4.4.5
security/tor: Update 0.4.3.6 -> 0.4.4.5

Changelog: https://gitweb.torproject.org/tor.git/tree/ReleaseNotes?h=tor-0.4.4.5

MFH:		2020Q3 (contains many major bugfixes)
5110e246e8
Yuri Victorovich (yuri) · 0.4.3.6
security/tor: Update 0.4.3.5 -> 0.4.3.6 (contains major and minor security and crash bugfixes)

Changelog: https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.4.3.6

Reported by:	upstream notification
MFH:		2020Q3 (bugfixes)
000bcbe23e
Yuri Victorovich (yuri) · 0.4.3.5
security/tor: Update 0.4.2.7 -> 0.4.3.5

Reported by:	upstream notification
f006cb9060
Yuri Victorovich (yuri) · 0.4.2.7
security/tor: Update 0.4.2.6 -> 0.4.2.7

Bugfix release: https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.4.2.7

Reported by:	upstream notification
MFH:		2020Q1
1b8280c8ba
Yuri Victorovich (yuri) · 0.4.2.6
security/tor: Update 0.4.2.5 -> 0.4.2.6

Changelog: https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.4.2.6

Reported by:	upstream notification
6d5f81a802
Yuri Victorovich (yuri) · 0.4.2.5
security/tor: Update 0.4.1.6 -> 0.4.2.5

Reported by:	upstream notification
420f4e460e
Baptiste Daroussin (bapt) · 0.4.1.6
Drop the ipv6 virtual category for s* category as it is not relevant anymore
ef71a0d8c9
Yuri Victorovich (yuri) · 0.4.1.6
security/tor: Update 0.4.1.5 -> 0.4.1.6

Reported by:	upstream notification
fe8ab18362
Yuri Victorovich (yuri) · 0.4.1.5
security/tor: Update 0.4.0.5 -> 0.4.1.5

Reported by:	upstream notification
2c9aa99585
Mathieu Arnold (mat) · 0.4.0.5_3
Convert to UCL & cleanup pkg-message (categories s)
bc89cd3d2c
Jan Beich (jbeich) · 0.4.0.5_3
devel/libevent2: update to 2.1.11

Changes:	https://github.com/libevent/libevent/releases/tag/release-2.1.11-stable
ABI:		https://abi-laboratory.pro/tracker/timeline/libevent/
PR:		239599
Reported by:	GitHub (watch releases)
Approved by:	zeising (maintainer)
MFH:		2019Q3 (maybe security, partially restores 2.1.8 ABI)
Differential Revision:	https://reviews.freebsd.org/D21133
f18538b989
Gerald Pfeifer (gerald) · 0.4.0.5_2
Bump PORTREVISION for ports depending on the canonical version of GCC as defined in Mk/bsd.default-versions.mk which has moved from GCC 8.3 to GCC 9.1 under most circumstances now after revision 507371.

This includes ports
 - with USE_GCC=yes or USE_GCC=any,
 - with USES=fortran,
 - using Mk/bsd.octave.mk which in turn features USES=fortran, and
 - with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
   c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, everything INDEX-11 shows with a dependency on lang/gcc9 now.

PR:		238330
ea8c8ec7da
Jan Beich (jbeich) · 0.4.0.5_1
security/tor: force rebuild after r503790

evutil_secure_rng_add_bytes became nop in r478104 on all FreeBSD
releases due to a bug in arc4random_addrandom ifdef. libevent 2.1.10
hidden it based on configure check. Looks like there were consumers.

PR:		238433
Reported by:	yuri
338d1782dc
Yuri Victorovich (yuri) · 0.4.0.5
security/tor: Update 0.3.5.8 -> 0.4.0.5

Reported by:	upstream notification
d52e9b9423
Yuri Victorovich (yuri) · 0.3.5.8
security/tor: 0.3.5.7 -> 0.3.5.8

Changelog: https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.3.5.8

Reported by:	upstream notifucation
3c5122a8b8
Yuri Victorovich (yuri) · 0.3.5.7
security/tor: Update 0.3.4.9 -> 0.3.5.7

The TOR2WEB option is retired by the upstream.

Reported by:	upstream notification
2a08076c51
Gerald Pfeifer (gerald) · 0.3.4.9_1
Bump PORTREVISION for ports depending on the canonical version of GCC defined via Mk/bsd.default-versions.mk which has moved from GCC 7.4 t GCC 8.2 under most circumstances.

This includes ports
 - with USE_GCC=yes or USE_GCC=any,
 - with USES=fortran,
 - using Mk/bsd.octave.mk which in turn features USES=fortran, and
 - with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
   c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, as a double check, everything INDEX-11 showed depending on lang/gcc7.

PR:		231590
a9f015d155
Yuri Victorovich (yuri) · 0.3.4.9
security/tor: Update 0.3.4.8 -> 0.3.4.9

Changelog:
https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.3.4.9

Reported by:	upstream notification
6e5e5d9012
Yuri Victorovich (yuri) · 0.3.4.8
security/tor: Fix build with mips64, powerpc64 and sparc64

Port changes:
* Add USES=compiler:c11
* Add USE_CSTD=gnu99

Situation with MIPS isn't clear, Nathan <ndowens@yahoo.com> says that it works only after adding USES=autoreconf.
The Tor Project should resolve this discrepancy that autoreconf alters the outcome: https://trac.torproject.org/projects/tor/ticket/27901

PR:		231779
Submitted by:	Piotr Kubaj <pkubaj@anongoth.pl> (initial version)
f188497994
Yuri Victorovich (yuri) · 0.3.4.8
security/tor: Update 0.3.3.9 -> 0.3.4.8

Changelog:
https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.3.4.8

Reported by:	Upstream notification
56fdf45cf7
Yuri Victorovich (yuri) · 0.3.3.9
security/tor: Update 0.3.3.8 -> 0.3.3.9

Changelog:
https://gitweb.torproject.org/tor.git/tree/ReleaseNotes?h=tor-0.3.3.9

Reported by:	upstream notification
214a8d95db
Yuri Victorovich (yuri) · 0.3.3.8
security/tor: Update 0.3.3.7 -> 0.3.3.8

Changelog:
https://gitweb.torproject.org/tor.git/tree/ChangeLog?id=99f9816efa08ab83f90a307ea41844d693488fde

Reported by:	upstream notification
0015cb2ad0
Yuri Victorovich (yuri) · 0.3.3.7
security/tor: Update 0.3.3.6 -> 0.3.3.7

Changelog:
https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.3.3.7

Reported by:	Nick Mathewson <nickm@torproject.org> (upstream notification)
d73afed2c7
Yuri Victorovich (yuri) · 0.3.3.6
security/tor: Update 0.3.2.10 -> 0.3.3.6

Changelog:
https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.3.3.6

Reported by:	Nick Mathewson <nickm@torproject.org> (upstream notification)
5c268b0672
Yuri Victorovich (yuri) · 0.3.2.10
security/tor: Update to 0.3.2.10

Backport of countermeasures to mitigate denial-of-service
attacks against the Tor network.

Changelog is in:
https://gitweb.torproject.org/tor.git/tree/ChangeLog

None of these fixes appear to be essential for clients, but relays
should upgrade.

Port changes:
* Changed the implementation of 'tor_setuid': now it is done through
  the command line argument, instead of the torrc file.

Reported by:	Nick Mathewson <nickm@torproject.org> (notification)
Approved by:	tcberner (mentor, implicit)
5c3a344f6e
Yuri Victorovich (yuri) · 0.3.2.9
security/tor: Update to 0.3.2.9

This release contains many new features and many bugfixes.
Plesee see the complete list here:
https://blog.torproject.org/tor-0329-released-we-have-new-stable-series

Additionally, this update adds "#include <osreldate.h>" to qualm the
compiler warning that was caused by the previous fix.

Now security/tor and security/tor-devel are identical.

Submitted by:	myself
Reported by:	upstream notification
Approved by:	adamw (mentor)
Differential Revision:	https://reviews.freebsd.org/D13820
f0ad21c6bb
Yuri Victorovich (yuri) · 0.3.1.9_1
security/tor: Unbreaking on systems without timingsafe_memcmp(3)

timingsafe_memcmp(3) has only been introduced in 12, therefore limiting its use to 12.

Reported by:	Martin Gehlen <zitlo@zitlo.de> (bug reporter)
Approved by:	adamw (mentor)
Differential Revision:	https://reviews.freebsd.org/D13502
5fdbf108c4
Yuri Victorovich (yuri) · 0.3.1.9
security/tor: Update to 0.3.1.9 (security update)

Approved by:	tcberner (mentor)
Differential Revision:	https://reviews.freebsd.org/D13321
5dff2c9118
Steve Wills (swills) · 0.3.1.8
security/tor: Update to 0.3.1.8

PR:		223239
Submitted by:	Yuri Victorovich <yuri@rawbw.com> (maintainer)
90310bba1c
Kurt Jaeger (pi) · 0.3.1.7
security/tor: update 0.3.0.10 -> 0.3.1.7

- Adds Lzma and Zstd compression
- Rework some options to options_ng

PR:		222431
Submitted by:	brnrd, Yuri Victorovich <yuri@rawbw.com> (maintainer)
d077c67d1b
Gerald Pfeifer (gerald) · 0.3.0.10_1
Bump PORTREVISION for ports depending on the canonical version of GCC (via Mk/bsd.default-versions.mk and lang/gcc) which has moved from GCC 5.4 to GCC 6.4 under most circumstances.

This includes ports
 - with USE_GCC=yes or USE_GCC=any,
 - with USES=fortran,
 - using Mk/bsd.octave.mk which in turn features USES=fortran, and
 - with USES=compiler specifying openmp, nestedfct, c++11-lib, c++11-lang,
   c++14-lang, c++0x, c11, or gcc-c++11-lib.

PR:		219275
e59c88cece
Kirill Ponomarev (krion) · 0.3.0.10
Update to version 0.3.0.10

PR:		221299
Submitted by:	maintainer
Approved by:	mat (mentor)
Differential Revision:	https://reviews.freebsd.org/D11909
2843ab3fd7
Dmitry Marakasov (amdmi3) · 0.3.0.9
- Update to 0.3.0.9

PR:		220373
Submitted by:	yuri@rawbw.com (maintainer)
Security:	CVE-2017-0377
833f6610d0
Mark Linimon (linimon) · 0.3.0.8_1
Begin deorbit burn of ia64.  We have not attempted to build packages for it for many years.

While here, alphabetize ARCHs, pet portlint, and modernize usages.

Approved by:	portmgr (tier-2 blanket)
45cb752a04
Jochen Neumeister (joneum) · 0.3.0.8_1
- security/tor: Implemented setuid feature  *The user should add tor_setuid=YES to /etc/rc.conf   to make tor do setuid in runtime after opening the   externally provided files.

PR:		218587
Submitted by:	xmj
Approved by:	Yuri Victorovich <yuri at rawbw.com> (maintainer)
Approved by:	miwi (mentor)
Differential Revision:	https://reviews.freebsd.org/D11223
325ef4e843
Kurt Jaeger (pi) · 0.3.0.8
security/tor: update 0.3.0.7 -> 0.3.0.8

PR:		219863
Submitted by:	Yuri Victorovich <yuri@rawbw.com> (maintainer)
MFH:		2017Q2
Relnotes:	https://gitweb.torproject.org/tor.git/plain/ReleaseNotes?id=tor-0.3.0.8
Security:	CVE-2017-0375, CVE-2017-0376
fb5089e52c
Kurt Jaeger (pi) · 0.3.0.7
security/tor: 0.3.0.6 -> 0.3.0.7

- medium-severity security bug in earlier versions of 0.3.0.x, where
  an attacker could cause a Tor relay process to exit

PR:		219246
Relnotes:	https://gitweb.torproject.org/tor.git/plain/ReleaseNotes?id=tor-0.3.0.7
Security:	TROVE-2017-002
Submitted by:	Yuri Victorovich <yuri@rawbw.com> (maintainer)
MFH:		2017Q2
91363d31d1
Sunpoet Po-Chuan Hsieh (sunpoet) · 0.3.0.6
Update to 0.3.0.6

- Add DOCS and MANPAGES options
- Remove TRANSPARENT option
- While I'm here, update WWW

Changes:	https://blog.torproject.org/category/tags/release
		https://gitweb.torproject.org/tor.git/tree/ChangeLog
PR:		219104
Submitted by:	Yuri Victorovich <yuri@rawbw.com> (maintainer)
0a35ac82fe
Mark Linimon (linimon) · 0.2.9.10
Provide more descriptive error messages for ports failing on powerpc64.

While here, pet portlint.

Approved by:	portmgr (tier-2 blanket)
b5fc89bb28
Shaun Amott (shaun) · 0.2.9.10
Update to 0.2.9.10.

PR:		217830
Submitted by:	Yuri Victorovich <yuri@rawbw.com> (maintainer)
6c3212f7b2
« newest← newerpage 2 of 5older →oldest »