Received: from mail.netbsd.org (mail.netbsd.org [149.20.53.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail.netbsd.org", Issuer "Postmaster NetBSD.org" (not verified)) by mollari.NetBSD.org (Postfix) with ESMTPS id 6E29FA582D for ; Wed, 8 Apr 2015 05:26:13 +0000 (UTC) Received: by mail.netbsd.org (Postfix, from userid 605) id DEC8714A1CE; Wed, 8 Apr 2015 05:26:12 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id B8E1214A1C4 for ; Wed, 8 Apr 2015 05:26:04 +0000 (UTC) X-Virus-Scanned: amavisd-new at NetBSD.org Received: from mail.netbsd.org ([127.0.0.1]) by localhost (mail.NetBSD.org [127.0.0.1]) (amavisd-new, port 10025) with ESMTP id p0g6XAG9zy4o for ; Wed, 8 Apr 2015 05:26:03 +0000 (UTC) Received: from cvs.netbsd.org (cvs.NetBSD.org [IPv6:2001:4f8:3:7:2e0:81ff:fe30:95bd]) by mail.netbsd.org (Postfix) with ESMTP id 0CBB214A1C2 for ; Wed, 8 Apr 2015 05:26:03 +0000 (UTC) Received: by cvs.netbsd.org (Postfix, from userid 500) id E89F498; Wed, 8 Apr 2015 05:26:02 +0000 (UTC) Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII" MIME-Version: 1.0 Date: Wed, 8 Apr 2015 05:26:02 +0000 From: "Thomas Klausner" Subject: CVS commit: pkgsrc/net/tor To: pkgsrc-changes@NetBSD.org Reply-To: wiz@netbsd.org X-Mailer: log_accum Message-Id: <20150408052602.E89F498@cvs.netbsd.org> Sender: pkgsrc-changes-owner@NetBSD.org List-Id: pkgsrc-changes.NetBSD.org Precedence: bulk Module Name: pkgsrc Committed By: wiz Date: Wed Apr 8 05:26:02 UTC 2015 Modified Files: pkgsrc/net/tor: Makefile distinfo Log Message: Update to 0.2.5.12, from Christian Sturm in PR 49823. Changes in version 0.2.5.12 - 2015-04-06 Tor 0.2.5.12 backports two fixes from 0.2.6.7 for security issues that could be used by an attacker to crash hidden services, or crash clients visiting hidden services. Hidden services should upgrade as soon as possible; clients should upgrade whenever packages become available. This release also backports a simple improvement to make hidden services a bit less vulnerable to denial-of-service attacks. o Major bugfixes (security, hidden service): - Fix an issue that would allow a malicious client to trigger an assertion failure and halt a hidden service. Fixes bug 15600; bugfix on 0.2.1.6-alpha. Reported by "disgleirio". - Fix a bug that could cause a client to crash with an assertion failure when parsing a malformed hidden service descriptor. Fixes bug 15601; bugfix on 0.2.1.5-alpha. Found by "DonnchaC". o Minor features (DoS-resistance, hidden service): - Introduction points no longer allow multiple INTRODUCE1 cells to arrive on the same circuit. This should make it more expensive for attackers to overwhelm hidden services with introductions. Resolves ticket 15515. To generate a diff of this commit: cvs rdiff -u -r1.101 -r1.102 pkgsrc/net/tor/Makefile cvs rdiff -u -r1.62 -r1.63 pkgsrc/net/tor/distinfo Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.