|
![]() [ View full size screenshot ] |
|
Reviewer: triumphtc Version: TOR For Windows 0.2.1.27 Date: Mar 6, 2011 Rating: |
only runs on firefox and will not run flashplayer otherwise very good |
| Version | Date Released | Status | Release Notes |
| 2.2.35-12 | May 22, 2012 | New Release | Major bugfixes: · Fix builds when the path to sed, openssl, or sha1sum contains spaces, which is pretty common on Windows. Fixes bug 5065; bugfix on 0.2.2.1-alpha. · Set the SO_REUSEADDR socket option before we call bind() on outgoing connections. This change should allow busy exit relays to stop running out of available sockets as quickly. Fixes bug 4950; bugfix on 0.2.2.26-beta. · Allow 0.2.3.x clients to use 0.2.2.x bridges. Previously the client would ask the bridge for microdescriptors, which are only supported in 0.2.3.x, and then fail to bootstrap when it didn't get the answers it wanted. Fixes bug 4013; bugfix on 0.2.3.2-alpha. · Avoid an assert when managed proxies like obfsproxy are configured, and we receive HUP signals or configuration values too rapidly. This situation happens most commonly when Vidalia tries to attach to Tor or tries to configure the Tor it's attached to. Fixes bug 5084; bugfix on 0.2.3.6-alpha. |
| 0.2.2.34-1 | Oct 3, 2011 | New Release | Privacy/anonymity fixes (clients): · Clients and bridges no longer send TLS certificate chains on outgoing OR · connections. Previously, each client or bridge would use the same cert chain · for all outgoing OR connections until its IP address changes, which allowed any · relay that the client or bridge contacted to determine which entry guards it is · using. Fixes CVE-2011-2768. Bugfix on 0.0.9pre5; found by "frosty_un". · If a relay receives a CREATE_FAST cell on a TLS connection, it no longer · considers that connection as suitable for satisfying a circuit EXTEND request. · Now relays can protect clients from the CVE-2011-2768 issue even if the clients · haven't upgraded yet. · Directory authorities no longer assign the Guard flag to relays that · haven't upgraded to the above "refuse EXTEND requests to client connections" · fix. Now directory authorities can protect clients from the CVE-2011-2768 issue · even if neither the clients nor the relays have upgraded yet. There's a new |
| 0.2.1.30 | Mar 12, 2011 | New Release | Major bugfixes (security), alsincluded in 0.2.1.29: · Fix a heap overflow bug where an adversary could cause heap corruption. This bug probably allows remote code execution attacks. Reported by "debuger". Fixes CVE-2011-0427. Bugfix on 0.1.2.10-rc. · Prevent a denial-of-service attack by disallowing any zlib-compressed data whose compression factor is implausibly high. Fixes part of bug 2324; reported by "doorss". · Zerout a few more keys in memory before freeing them. Fixes bug 2384 and part of bug 2385. These key instances found by "cypherpunks", based on Andrew Case's report about being able tfind sensitive data in Tor's memory space if you have enough permissions. Bugfix on 0.0.2pre9. Major bugfixes (crashes), alsincluded in 0.2.1.29: · Prevent calls tLibevent from inside Libevent log handlers. This had potential tcause a nasty set of crashes, especially if running Libevent with debug logging enabled, and running Tor with a controller watching for low-severity log messages. |
| 0.2.1.27 | Nov 25, 2010 | New Release | Major bugfixes: · Work around a security feature in OpenSSL 0.9.8l that prevents our handshake from working unless we explicitly tell OpenSSL that we are using SSL renegotiation safely. We are, of course, but OpenSSL 0.9.8l won't work unless we say we are. · Avoid crashing if the client is trying to upload many bytes and the circuit gets torn down at the same time, or if the flip side happens on the exit relay. Bugfix on 0.2.0.1-alpha; fixes bug 1150. Minor bugfixes: · Do not refuse to learn about authority certs and v2 networkstatus documents that are older than the latest consensus. This bug might have degraded client bootstrapping. |
| 0.2.1.21 | Dec 21, 2009 | New Release | o Major bugfixes: - Work around a security feature in OpenSSL 0.9.8l that prevents our handshake from working unless we explicitly tell OpenSSL that we are using SSL renegotiation safely. We are, of course, but OpenSSL 0.9.8l won't work unless we say we are. - Avoid crashing if the client is trying to upload many bytes and the circuit gets torn down at the same time, or if the flip side happens on the exit relay. Bugfix on 0.2.0.1-alpha; fixes bug 1150. o Minor bugfixes: - Do not refuse to learn about authority certs and v2 networkstatus documents that are older than the latest consensus. This bug might have degraded client bootstrapping. Bugfix on 0.2.0.10-alpha. Spotted and fixed by xmux. - Fix a couple of very-hard-to-trigger memory leaks, and one hard-to- trigger platform-specific option misparsing case found by Coverity Scan. |
| 0.2.0.32 | Dec 5, 2008 | New Release |