CVE-2012-4419
Last modified
CVE-2012-4419 is a vulnerability of currently unknown severity. The compare_tor_addr_to_addr_policy function in or/policies.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.21-rc, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a zero-valued port field that is not properly handled during policy comparison.. EPSS estimates a 2.16% chance of exploitation in the next 30 days.
Description
The compare_tor_addr_to_addr_policy function in or/policies.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.21-rc, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a zero-valued port field that is not properly handled during policy comparison.
Metrics
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Torproject | Tor | <= 0.2.2.38 | — |
| Torproject | Tor | 0.0.2 | — |
| Torproject | Tor | 0.0.3 | — |
| Torproject | Tor | 0.0.4 | — |
| Torproject | Tor | 0.0.5 | — |
| Torproject | Tor | 0.0.6 | — |
| Torproject | Tor | 0.0.6.1 | — |
| Torproject | Tor | 0.0.6.2 | — |
| Torproject | Tor | 0.0.7 | — |
| Torproject | Tor | 0.0.7.1 | — |
| Torproject | Tor | 0.0.7.2 | — |
| Torproject | Tor | 0.0.7.3 | — |
| Torproject | Tor | 0.0.8.1 | — |
| Torproject | Tor | 0.0.9.1 | — |
| Torproject | Tor | 0.0.9.2 | — |
| Torproject | Tor | 0.0.9.3 | — |
| Torproject | Tor | 0.0.9.4 | — |
| Torproject | Tor | 0.0.9.5 | — |
| Torproject | Tor | 0.0.9.6 | — |
| Torproject | Tor | 0.0.9.7 | — |
| Torproject | Tor | 0.0.9.8 | — |
| Torproject | Tor | 0.0.9.9 | — |
| Torproject | Tor | 0.0.9.10 | — |
| Torproject | Tor | 0.1.0.10 | — |
| Torproject | Tor | 0.1.0.11 | — |
| Torproject | Tor | 0.1.0.12 | — |
| Torproject | Tor | 0.1.0.13 | — |
| Torproject | Tor | 0.1.0.14 | — |
| Torproject | Tor | 0.1.0.15 | — |
| Torproject | Tor | 0.1.0.16 | — |
| Torproject | Tor | 0.1.0.17 | — |
| Torproject | Tor | 0.1.1.20 | — |
| Torproject | Tor | 0.1.1.21 | — |
| Torproject | Tor | 0.1.1.22 | — |
| Torproject | Tor | 0.1.1.23 | — |
| Torproject | Tor | 0.1.1.24 | — |
| Torproject | Tor | 0.1.1.25 | — |
| Torproject | Tor | 0.1.1.26 | — |
| Torproject | Tor | 0.1.2.13 | — |
| Torproject | Tor | 0.1.2.14 | — |
| Torproject | Tor | 0.1.2.15 | — |
| Torproject | Tor | 0.1.2.16 | — |
| Torproject | Tor | 0.1.2.17 | — |
| Torproject | Tor | 0.1.2.18 | — |
| Torproject | Tor | 0.1.2.19 | — |
| Torproject | Tor | 0.2.0.30 | — |
| Torproject | Tor | 0.2.0.31 | — |
| Torproject | Tor | 0.2.0.32 | — |
| Torproject | Tor | 0.2.0.33 | — |
| Torproject | Tor | 0.2.0.34 | — |
Showing 50 of 80 affected configurations. See NVD for the full list.
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2012-4419?
How severe is CVE-2012-4419?
How do I fix CVE-2012-4419?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2012
- CVE-2012-4413OpenStack Keystone 2012.1.3 does not invalidate existing tok…
- CVE-2012-4414Multiple SQL injection vulnerabilities in the replication co…
- CVE-2012-4415Stack-based buffer overflow in the guac_client_plugin_open f…
- CVE-2012-4416Unspecified vulnerability in the Java Runtime Environment (J…
- CVE-2012-4417GlusterFS 3.3.0, as used in Red Hat Storage server 2.0, allo…
- CVE-2012-4418Apache Axis2 allows remote attackers to forge messages and b…
- CVE-2012-4420An information disclosure flaw was found in the way the Java…7.5
- CVE-2012-4421The create_post function in wp-includes/class-wp-atom-server…
- CVE-2012-4422wp-admin/plugins.php in WordPress before 3.4.2, when the mul…
- CVE-2012-4423The virNetServerProgramDispatchCall function in libvirt befo…
- CVE-2012-4424Stack-based buffer overflow in string/strcoll_l.c in the GNU…
- CVE-2012-4425libgio, when used in setuid or other privileged programs in …
Are you affected by CVE-2012-4419?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST