CVE-2016-1254

Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor.

• CWE-119

• http://lists.opensuse.org/opensuse-updates/2016-12/msg00154.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-updates/2016-12/msg00155.htmlThird Party Advisory
• https://blog.torproject.org/blog/tor-02812-releasedVendor Advisory
• https://gitweb.torproject.org/tor.git/commit/?id=d978216dea6b21ac38230a59d172139185a68dbdPatch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FXOJSMCTIOHLBRYFBVEL3CDLGPZXX6WE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTU2R253477RZLYAJAR5DAXAON7KIVLA/
• https://trac.torproject.org/projects/tor/ticket/21018Issue Tracking, Vendor Advisory
• https://www.debian.org/security/2016/dsa-3741Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2016-12/msg00154.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-updates/2016-12/msg00155.htmlThird Party Advisory
• https://blog.torproject.org/blog/tor-02812-releasedVendor Advisory
• https://gitweb.torproject.org/tor.git/commit/?id=d978216dea6b21ac38230a59d172139185a68dbdPatch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FXOJSMCTIOHLBRYFBVEL3CDLGPZXX6WE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTU2R253477RZLYAJAR5DAXAON7KIVLA/
• https://trac.torproject.org/projects/tor/ticket/21018Issue Tracking, Vendor Advisory
• https://www.debian.org/security/2016/dsa-3741Third Party Advisory

Published

Dec 5, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-1248vim before patch 8.0.0056 does not properly validate values …
• CVE-2016-1249The DBD::mysql module before 4.039 for Perl, when using serv…
• CVE-2016-1250Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-1251There is a vulnerability of type use-after-free affecting DB…
• CVE-2016-1252The apt package in Debian jessie before 1.0.9.8.4, in Debian…5.9
• CVE-2016-1253The most package in Debian wheezy before 5.0.0a-2.2, in Debi…
• CVE-2016-1255The pg_ctlcluster script in postgresql-common package in Deb…
• CVE-2016-1256Juniper Junos OS before 12.1X44-D55, 12.1X46 before 12.1X46-…
• CVE-2016-1257The Routing Engine in Juniper Junos OS 13.2R5 through 13.2R8…
• CVE-2016-1258Embedthis Appweb, as used in J-Web in Juniper Junos OS befor…
• CVE-2016-1260Juniper Junos OS before 13.2X51-D36, 14.1X53 before 14.1X53-…
• CVE-2016-1261J-Web does not validate certain input that may lead to cross…7.1