Back Linuxsecurity

openSUSE Backports SLE-15-SP7 Tor Major Security Patch 2026-XYZ

Linuxsecurity •LinuxSecurity Advisories • May 13, 2026

This update for tor fixes the following issues: - Update to 0.4.9.8 * Fix out-of-bounds read (boo#1264341, CVE-2026-44597, TROVE-2026-011) * Do not attempt or accept BEGIN_DIR via conflux legs (boo#1264342, CVE-2026-44599,TROVE-2026-008) * Adjust conflux out-of-order queue accounting when clearing a queue (boo#1264343, CVE-2026-44600, TROVE-2026-010) * Fix a client-side crash caused by double-close of a circuit while under circuit queue memory pressure (boo#1264344, CVE-2026-44601, TROVE-2026-009) * Fix null pointer dereference when receiving a CERT cell out of order (boo#1264345, CVE-2026-44602, TROVE-2026-006) * Fix off-by-one out-of-bounds read if a malformed BEGIN cell is received (boo#1264346, CVE-2026-44603, TROVE-2026-007) - upate to 0.4.9.5: * first stable release in the 0.4.9 series * introduces a new circuit-level encryption design for better client security * introduce a

Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP7: zypper in -t patch openSUSE-2026-164=1

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Backports SLE-15-SP7:

zypper in -t patch openSUSE-2026-164=1

- openSUSE Backports SLE-15-SP7 (aarch64 ppc64le s390x x86_64): tor-0.4.9.8-bp157.2.9.1

- openSUSE Backports SLE-15-SP7 (aarch64 ppc64le s390x x86_64):

tor-0.4.9.8-bp157.2.9.1

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

openSUSE Tor Security Updates Address Multiple Vulnerabilities openSUSE has released critical updates for the Tor software, addressing several vulnerabilities identified as CVE-2026-44597, CVE-2026-44599, CVE-2026-44600, CVE-2026-44601, CVE-2026-44602, and CVE-2026-44603. These vulnerabilities include issues such as out-of-bounds reads, null pointer dereferences, and circuit management flaws that could lead to client crashes or data exposure. The updates affect both openSUSE Backports SLE-15-SP7 and openSUSE Leap 16.0. The patches were released on May 10 and May 13, 2026, with the vulnerabilities being published on May 7, 2026. Users are advised to apply the updates promptly to mitigate potential exploitation risks. The updates introduce a new circuit-level encryption design aimed at enhancing client security. 2 sources 73

Extracted Entities

openSUSE Backports SLE-15-SP7 Tor Major Security Patch 2026-XYZ

The full story

Extracted Entities

Companies (1)

CVEs (6)

CWE Weaknesses (2)

IP Addresses (1)