Accepted tor 0.2.4.26-1~deb6u1 (source all) into squeeze-lts
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Sun, 22 Mar 2015 20:18:45 +0100
Source: tor
Binary: tor tor-dbg tor-geoipdb
Architecture: source all
Version: 0.2.4.26-1~deb6u1
Distribution: squeeze-lts
Urgency: medium
Maintainer: Peter Palfrader <weasel@debian.org>
Changed-By: Peter Palfrader <weasel@debian.org>
Description:
tor - anonymizing overlay network for TCP
tor-dbg - debugging symbols for Tor
tor-geoipdb - GeoIP database for Tor
Changes:
tor (0.2.4.26-1~deb6u1) squeeze-lts; urgency=medium
.
* New upstream version.
+ Fixes the following security relevant issues (copied from upstream
changelog):
- Fix an assertion failure that could occur under high DNS load.
Fixes bug 14129; bugfix on Tor 0.0.7rc1. Found by "jowr";
diagnosed and fixed by "cypherpunks".
- Fix a bug that could lead to a relay crashing with an assertion
failure if a buffer of exactly the wrong layout was passed to
buf_pullup() at exactly the wrong time. Fixes bug 15083; bugfix on
0.2.0.10-alpha. Patch from 'cypherpunks'.
- Do not assert if the 'data' pointer on a buffer is advanced to the
very end of the buffer; log a BUG message instead. Only assert if
it is past that point. Fixes bug 15083; bugfix on 0.2.0.10-alpha.
- Disable support for SSLv3. All versions of OpenSSL in use with Tor
today support TLS 1.0 or later, so we can safely turn off support
for this old (and insecure) protocol. Fixes bug 13426.
+ Updates the list of directory authorities and the geoIP database.
+ Use correct byte order when sending the address of the chosen rendezvous
point to a hidden service. This bug meant that clients were leaking to
the hidden service whether they were on a little-endian (common) or
big-endian (rare) system.
Checksums-Sha1:
4f55b524ab41e61751198c4d74b66c35f050e69a 1595 tor_0.2.4.26-1~deb6u1.dsc
394b5485ea01bc8cf5620273ad60551a6e2d6d8b 3132691 tor_0.2.4.26.orig.tar.gz
fd3ba6c1c4c31fe40abe0be998d54191ce2c0ed4 35743 tor_0.2.4.26-1~deb6u1.diff.gz
09bba973b775f76b198a3ee88d587da8c377d1d1 1199420 tor-geoipdb_0.2.4.26-1~deb6u1_all.deb
Checksums-Sha256:
d749607727a6243ca36d45841619e8958a3f1e5e94f50771c40658cef57c8d9e 1595 tor_0.2.4.26-1~deb6u1.dsc
7095469ea65fe309194e0885f9c4dabf5742704fca1f11d3a645224336b9303d 3132691 tor_0.2.4.26.orig.tar.gz
590bb5b82d4002721017ba1aed818b0eb946b01cbcd4b3e5af6ade7c90d29898 35743 tor_0.2.4.26-1~deb6u1.diff.gz
c7b03501ada4185641547ec8e9d926992793ba0b4e4a11c5704b84f03cc6df13 1199420 tor-geoipdb_0.2.4.26-1~deb6u1_all.deb
Files:
4272cef488d7935fd37394e6bfee1c9c 1595 net optional tor_0.2.4.26-1~deb6u1.dsc
ae923e0a6fcbd4b5cde7cf87b525fe61 3132691 net optional tor_0.2.4.26.orig.tar.gz
b3ea9760170a43db6183056c8c70df5c 35743 net optional tor_0.2.4.26-1~deb6u1.diff.gz
a26e3ff587f685c0ddab2da99b15dae2 1199420 net extra tor-geoipdb_0.2.4.26-1~deb6u1_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAEBCAAGBQJVDx+/AAoJEIYCyCA4cjMfSX4H+QEc55WpazVcRpWzzq/5/bBg
LI7aJIStlW3j8BrsKtVBH+xKSPdjzk5FKI1nBOn+p7e82YabpNUaVg+HGpPzBkWC
48UpcA41xhvtRcFbfVkTskMGpuX9j/DoIXjy1AoEfHOrCcdzIPaVWwDm/46yAtLJ
L1L6TxGdpwsa+5bWLbX2TNgtNbFgPvkRi4sNRCwxfQZQVEQbOU9Vkblr+2t7fQ2F
iwXWcThDVJ0f/DK+0z0FBq3tNDfMylb1xqN1Pw0oF/FMxHV2nzwWN9ymmDUXNmEA
uIXC3LVhXnwpriKB0wG7eBag0CpKqu6kBaOo5pH+6CLgQSPKIVaaqrGXxmn2ejA=
=eV+I
-----END PGP SIGNATURE-----