| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: tor | Distribution: openSUSE Tumbleweed |
| Version: 0.4.9.9 | Vendor: openSUSE |
| Release: 2.2 | Build date: Thu Jul 16 23:43:44 2026 |
| Group: Unspecified | Build host: reproducible |
| Size: 34894831 | Source RPM: tor-0.4.9.9-2.2.src.rpm |
| Packager: http://bugs.opensuse.org | |
| Url: https://www.torproject.org/ | |
| Summary: Anonymizing overlay network for TCP (The onion router) | |
Tor is a connection-based low-latency anonymous communication system. This package provides the "tor" program, which serves as both a client and a relay node. Scripts will automatically create a "tor" user and a "tor" group, and set tor up to run as a daemon when the system is rebooted. Applications connect to the local Tor proxy using the SOCKS protocol. The tor client chooses a path through a set of relays, in which each relay knows its predecessor and successor, but no others. Traffic flowing down the circuit is unwrapped by a symmetric key at each relay, which reveals the downstream relay. Warnings: Tor does no protocol cleaning. That means there is a danger that application protocols and associated programs can be induced to reveal information about the initiator. Tor depends on Privoxy or similar protocol cleaners to solve this problem. This is alpha code, and is even more likely than released code to have anonymity-spoiling bugs. The present network is small -- this further reduces the strength of the anonymity provided. Tor is not presently suitable for high-stakes anonymity.
BSD-3-Clause
* Thu Jul 16 2026 Bernhard Wiedemann <bwiedemann@suse.de>
- Create the tor user and group via sysusers.d (new source:
system-user-tor.conf) instead of useradd in %pre, which lacked an
install-time dependency on shadow
- Drop fillup usage: no sysconfig fillup template is shipped
- Use %tmpfiles_create instead of calling systemd-tmpfiles directly
- Own /run/tor as %ghost (fixes rpmlint tmpfile-not-in-filelist)
- Simplify tarball checksum verification in %prep
- Drop creation of the unpackaged /var/tmp/tor directory
- tor.service: drop obsolete syslog.target ordering, drop the
deprecated no-op PermissionsStartOnly, drop ReadOnlyDirectories=/
(redundant with ProtectSystem=strict) and rename
ReadWriteDirectories to ReadWritePaths
* Tue Jun 02 2026 Bernhard Wiedemann <bwiedemann@suse.de>
- Update to 0.4.9.9
* Major bugfixes (compression, security):
- Fix a compression bomb bypass where an attacker could concatenate
many gzip or zlib sub-streams, each just under the per-stream
detection threshold, to avoid the compression bomb check entirely.
TROVE-2026-022. Fixes bug 41275; bugfix on 0.3.1.1-alpha.
- Fix an infinite loop when decompressing a truncated zlib/gzip
stream with done=1. A truncated stream never reaches Z_STREAM_END,
causing zlib to return Z_BUF_ERROR with no input remaining, which
buf_add_compress() mistook for a full output buffer and retried
forever. Fixed by returning TOR_COMPRESS_ERROR in that case so the
caller can abort cleanly. TROVE-2026-021. Fixes bug 41274; bugfix
on 0.2.6.1-alpha.
* Major bugfixes (conflux, security):
- Fix a NULL write after free when sending a CONFLUX_SWITCH cell
fails. The return value of relay_send_command_from_edge() was
ignored, so a send failure (which calls circuit_mark_for_close()
and removes the leg via cfx_del_leg()) would go undetected,
causing the caller to write to the now-freed current leg and
resulting in a crash. TROVE-2026-017. Fixes bug 41263; bugfix
on 0.4.8.1-alpha.
* Major bugfixes (security, TROVE-2026-019):
- Avoid out-of-bounds read/write when parsing a consensus or
detached signature with unexpected signature digest type. Impact
is minor for most Tor roles, but potentially major for directory
authorities. Fixes bug 41267; bugfix on 0.2.8.2-alpha.
* Major bugfixes (client stability, TROVE-2026-013, TROVE-2026-015):
- Protect against a client-side assert that can happen if a
malicious onion service gets the client to load its carefully
crafted onion descriptor. Fixes bugs 41259 and 41261; bugfix
on 0.3.1.1-alpha.
* Major bugfixes (code safety):
- Avoid a dangerous situation in router_find_exact_exit_enclave()
where we could have reached an assert if bridges or relays claim
an IP address of 0.0.0.0. Fixes bug 41276; bugfix on 0.4.5.1-alpha.
* Major bugfixes (conflux, shutdown):
- Fix a use-after-free in the shutdown path when freeing conflux
circuits. cfx_add_leg() shares stream list pointers across legs
without NULLing the old leg, so circuit_free_all() would free the
lists via one leg and then access freed memory via another. TROVE-
2026-016. Fixes bug 41262; bugfix on 0.4.8.1-alpha.
* Major bugfixes (DNSPort, TROVE-2026-018):
- Fix a client-side crash that would happen if we decide to stop
reading on a RESOLVE request that came from the DNSPort or
controller. This crash could happen naturally under heavy load and
with poor luck, but since 0.4.7.2-alpha it could be induced by the
exit relay via a flow control request. Fixes bug 41265; bugfix
on 0.2.0.1-alpha.
* Major bugfixes (memory safety, TROVE-2026-014):
- Avoid a heap-use-after-free mistake that can happen in the conflux
subsystem, and which can be induced at either the client or the
exit relay. Fixes bug 41260; bugfix on 0.4.8.1-alpha.
* Major bugfixes (onion services, TROVE-2026-020):
- Avoid a possible divide by zero crash on onion services that have
the proof-of-work (PoW) defense enabled. This bug could be hit by
extreme bad luck or maybe by the help of an attacker crafting just
the right circumstances. Fixes bug 41270; bugfix on 0.4.8.1-alpha.
* Fri May 08 2026 Bernhard Wiedemann <bwiedemann@suse.de>
- Update to 0.4.9.8
* Fix out-of-bounds read (boo#1264341, CVE-2026-44597, TROVE-2026-011)
* Do not attempt or accept BEGIN_DIR via conflux legs
(boo#1264342, CVE-2026-44599,TROVE-2026-008)
* Adjust conflux out-of-order queue accounting when clearing a queue
(boo#1264343, CVE-2026-44600, TROVE-2026-010)
* Fix a client-side crash caused by double-close of a circuit while
under circuit queue memory pressure
(boo#1264344, CVE-2026-44601, TROVE-2026-009)
* Fix null pointer dereference when receiving a CERT cell out of
order (boo#1264345, CVE-2026-44602, TROVE-2026-006)
* Fix off-by-one out-of-bounds read if a malformed BEGIN cell is
received (boo#1264346, CVE-2026-44603, TROVE-2026-007)
* Sun Apr 19 2026 Andreas Stieger <andreas.stieger@gmx.de>
- upate to 0.4.9.5:
* first stable release in the 0.4.9 series
* introduces a new circuit-level encryption design for better
client security
* introduce a more scalable way for large relay operators to
annotate which relays they run so clients can avoid using too
many of them in a single circuit
* Sun Apr 19 2026 Andreas Stieger <andreas.stieger@gmx.de>
- update to 0.4.8.23:
* Fix a memory compare using the wrong length. This could lead to
a remote crash when using the conflux subsystem
(TROVE-2026-004, boo#1262302)
* Fix a series of defense in depth security issues found across
the codebase
* Regenerate fallback directories generated on March 25, 2026.
* Update the geoip files to match the IPFire Location Database,
as retrieved on 2026/03/25.
- includes changes from 0.4.8.22:
* Avoid an out-of-bounds read error that could occur with
V1-formatted EXTEND cells
(TROVE-2025-016, boo#1262301)
* Allow old clients to fetch the consensus even if they use
version 0 of the SENDME protocol
* Do not check for compression bombs for buffers smaller than
5MB (increased from 64 KB)
* Improvements to directory server statistics
* Sat Jan 03 2026 Dirk Müller <dmueller@suse.com>
- update to 0.4.8.21:
* This release is a continuation of the previous one and
addresses additional Conflux-related issues identified through
further testing and feedback from relay operators. We strongly
recommend upgrading as soon as possible.
* Major bugfixes (conflux, exit):
- When dequeuing out-of-order conflux cells, the circuit
could be close in between two dequeue which could lead to a
mishandling of a NULL pointer. Fixes bug 41162;
* Add -mbranch-protection=standard for arm64.
* Regenerate fallback directories generated on November
* Update the geoip files to match the IPFire Location
Database, as retrieved on 2025/11/17.
* Fix a bug causing the initial tor process to hang
intead of exiting with RunAsDaemon, when pluggable transports
are used.
* Wed Nov 12 2025 Bernhard Wiedemann <bwiedemann@suse.de>
- 0.4.8.20
* Add a new hardening compiler flag -fcf-protection=full
* Fix the root cause of some conflux fragile asserts
* Fix a series of conflux edge cases
* Wed Oct 08 2025 Bernhard Wiedemann <bwiedemann@suse.de>
- 0.4.8.19
* Fix some clients not being able to connect to LibreSSL relays
* Improve stream flow control performance
* Wed Sep 17 2025 Bernhard Wiedemann <bwiedemann@suse.de>
- 0.4.8.18
* CVE-2025-4444: onion service descriptor resource consumption
issue (boo#1250101)
* Tue Jul 01 2025 Bernhard Wiedemann <bwiedemann@suse.com>
- 0.4.8.17
* Minor features and bugfixes
* use quantum-resistant MLKEM-768 cipher
* Mon Apr 21 2025 Andreas Stieger <andreas.stieger@gmx.de>
- tor 0.4.8.16
* fix typo in a directory authority rule file
* fix a sandbox issue for bandwidth authority and a conflux issue
on the control port
* client fix about relay flag usage
* Wed Feb 05 2025 Bernhard Wiedemann <bwiedemann@suse.com>
- tor 0.4.8.14
* bugfix for onion service directory cache
* test-network now unconditionally includes IPv6
* Regenerate fallback directories 2025-02-05
* Update the geoip files to 2025-02-05
* Fix a pointer free
* Fri Dec 27 2024 Andreas Stieger <andreas.stieger@gmx.de>
- tor 0.4.8.13
* Conflux related client circuit building performance bugfix
* Fix minor memory leaks
* Add STATUS TYPE=version handler for Pluggable Transport
* Tue Jun 11 2024 Bernhard Wiedemann <bwiedemann@suse.com>
- tor 0.4.8.12
* Minor features and bugfixes
* See https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.8/ReleaseNotes
* Thu Apr 11 2024 Bernhard Wiedemann <bwiedemann@suse.de>
- tor 0.4.8.11
* Minor features and bugfixes
* See https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.8/ReleaseNotes
* Wed Feb 14 2024 Martin Pluskal <mpluskal@suse.com>
- Enables scrypt support unconditionally
* Mon Feb 05 2024 Andreas Stieger <andreas.stieger@gmx.de>
- fix users/groups with rpm 4.19
* Fri Dec 08 2023 Bernhard Wiedemann <bwiedemann@suse.de>
- tor 0.4.8.10:
* (TROVE-2023-007, exit) (boo#1217918)
- fix a a UAF and NULL pointer dereference crash on Exit relays
* Thu Nov 09 2023 Bernhard Wiedemann <bwiedemann@suse.com>
- tor 0.4.8.9:
* (onion service, TROVE-2023-006):
- Fix a possible hard assert on a NULL pointer
* (guard usage):
- When Tor excluded a guard due to temporary circuit restrictions,
it considered *additional* primary guards for potential usage by
that circuit.
* Fri Nov 03 2023 Andreas Stieger <andreas.stieger@gmx.de>
- tor 0.4.8.8:
* Mitigate an issue when Tor compiled with OpenSSL can crash during
handshake with a remote relay. (TROVE-2023-004, boo#1216873)
* Regenerate fallback directories generated on November 03, 2023.
* Update the geoip files to match the IPFire Location Database, as
retrieved on 2023/11/03
* directory authority: Look at the network parameter
"maxunmeasuredbw" with the correct spelling
* vanguards addon support: Count the conflux linked cell as
valid when it is successfully processed. This will quiet a
spurious warn in the vanguards addon
* Mon Sep 25 2023 Andreas Stieger <andreas.stieger@gmx.de>
- tor 0.4.8.7:
* Fix an issue that prevented us from pre-building more conflux
sets after existing sets had been used
* Tue Sep 19 2023 Andreas Stieger <andreas.stieger@gmx.de>
- tor 0.4.8.6:
* onion service: Fix a reliability issue where services were
expiring their introduction points every consensus update.
This caused connectivity issues for clients caching the old
descriptor and intro points
* Log the input and output buffer sizes when we detect a potential
compression bomb
* Disable multiple BUG warnings of a missing relay identity key when
starting an instance of Tor compiled without relay support
* When reporting a pseudo-networkstatus as a bridge authority, or
answering "ns/purpose/*" controller requests, include accurate
published-on dates from our list of router descriptors
* Use less frightening language and lower the log-level of our
run-time ABI compatibility check message in our Zstd
compression subsystem
* Wed Aug 30 2023 Andreas Stieger <andreas.stieger@gmx.de>
- tor 0.4.8.5:
* bugfixes creating log BUG stacktrace
* Sun Aug 27 2023 Andreas Stieger <andreas.stieger@gmx.de>
- tor 0.4.8.4:
* Extend DoS protection to partially opened channels and known
relays
* Dynamic Proof-Of-Work protocol to thwart flooding DoS attacks
against hidden services. Disabled by default, enable via
"HiddenServicePoW" in torrc
* Implement conflux traffic splitting
* Directory authorities and relays now interact properly with
directory authorities if they change addresses
* Sun Jul 30 2023 Andreas Stieger <andreas.stieger@gmx.de>
- tor 0.4.7.14:
* bugfix affecting vanguards (onion service), and minor fixes
* Fri Mar 10 2023 Martin Pluskal <mpluskal@suse.com>
- Enable support for scrypt()
* Fri Jan 13 2023 Bernhard Wiedemann <bwiedemann@suse.com>
- tor 0.4.7.13:
* fix SafeSocks option to avoid DNS leaks (boo#1207110, TROVE-2022-002)
* improve congestion control
* fix relay channel handling
/etc/logrotate.d/tor /etc/tor /etc/tor/torrc /etc/tor/torrc.minimal /etc/tor/torrc.sample /run/tor /usr/bin/tor /usr/bin/tor-gencert /usr/bin/tor-print-ed-signing-cert /usr/bin/tor-resolve /usr/bin/torify /usr/lib/systemd/system/tor-master.service /usr/lib/systemd/system/tor.service /usr/lib/sysusers.d/system-user-tor.conf /usr/lib/tmpfiles.d/tor.conf /usr/sbin/rctor /usr/sbin/rctor-master /usr/share/doc/packages/tor /usr/share/doc/packages/tor/ChangeLog /usr/share/doc/packages/tor/HACKING /usr/share/doc/packages/tor/HACKING/CodingStandards.md /usr/share/doc/packages/tor/HACKING/Fuzzing.md /usr/share/doc/packages/tor/HACKING/GettingStarted.md /usr/share/doc/packages/tor/HACKING/HelpfulTools.md /usr/share/doc/packages/tor/HACKING/HowToReview.md /usr/share/doc/packages/tor/HACKING/Module.md /usr/share/doc/packages/tor/HACKING/README.1st.md /usr/share/doc/packages/tor/HACKING/ReleasingTor.md /usr/share/doc/packages/tor/HACKING/WritingTests.md /usr/share/doc/packages/tor/HACKING/tracing /usr/share/doc/packages/tor/HACKING/tracing/EventsCircuit.md /usr/share/doc/packages/tor/HACKING/tracing/README.md /usr/share/doc/packages/tor/README.md /usr/share/doc/packages/tor/tor-gencert.html /usr/share/doc/packages/tor/tor-print-ed-signing-cert.html /usr/share/doc/packages/tor/tor-resolve.html /usr/share/doc/packages/tor/tor.html /usr/share/doc/packages/tor/torify.html /usr/share/licenses/tor /usr/share/licenses/tor/LICENSE /usr/share/man/man1/tor-gencert.1.gz /usr/share/man/man1/tor-print-ed-signing-cert.1.gz /usr/share/man/man1/tor-resolve.1.gz /usr/share/man/man1/tor.1.gz /usr/share/man/man1/torify.1.gz /usr/share/tor /usr/share/tor/defaults-torrc /usr/share/tor/geoip /usr/share/tor/geoip6 /var/lib/tor /var/log/tor
Generated by rpm2html 1.8.1
Fabrice Bellet, Sun Aug 2 02:32:54 2026