CVE-2011-1924

Buffer overflow in the policy_summarize function in or/policies.c in Tor before 0.2.1.30 allows remote attackers to cause a denial of service (directory authority crash) via a crafted policy that triggers creation of a long port list.

• CWE-119

• http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061258.html
• http://secunia.com/advisories/43548Vendor Advisory
• http://secunia.com/advisories/44862Vendor Advisory
• http://www.securityfocus.com/bid/46618
• https://bugzilla.redhat.com/show_bug.cgi?id=705192Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=705194
• https://gitweb.torproject.org/tor.git/commit/43414eb98821d3b5c6c65181d7545ce938f82c8ePatch
• https://lists.torproject.org/pipermail/tor-announce/2011-February/000000.htmlPatch
• http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061258.html
• http://secunia.com/advisories/43548Vendor Advisory
• http://secunia.com/advisories/44862Vendor Advisory
• http://www.securityfocus.com/bid/46618
• https://bugzilla.redhat.com/show_bug.cgi?id=705192Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=705194
• https://gitweb.torproject.org/tor.git/commit/43414eb98821d3b5c6c65181d7545ce938f82c8ePatch
• https://lists.torproject.org/pipermail/tor-announce/2011-February/000000.htmlPatch

Published

Jun 14, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-1918Stack-based buffer overflow in the Data Archiver service in …
• CVE-2011-1919Multiple stack-based buffer overflows in GE Intelligent Plat…
• CVE-2011-1920The make include files in NetBSD before 1.6.2, as used in pm…
• CVE-2011-1921The mod_dav_svn module for the Apache HTTP Server, as distri…
• CVE-2011-1922daemon/worker.c in Unbound 1.x before 1.4.10, when debugging…
• CVE-2011-1923The Diffie-Hellman key-exchange implementation in dhm.c in P…
• CVE-2011-1925nbd-server.c in Network Block Device (nbd-server) 2.9.21 all…
• CVE-2011-1926The STARTTLS implementation in Cyrus IMAP Server before 2.4.…
• CVE-2011-1927The ip_expire function in net/ipv4/ip_fragment.c in the Linu…
• CVE-2011-1928The fnmatch implementation in apr_fnmatch.c in the Apache Po…
• CVE-2011-1929lib-mail/message-header-parser.c in Dovecot 1.2.x before 1.2…
• CVE-2011-1930In klibc 1.5.20 and 1.5.21, the DHCP options written by ipco…9.8