diff options
Diffstat (limited to 'ReleaseNotes')
| -rw-r--r-- | ReleaseNotes | 29 |
1 files changed, 22 insertions, 7 deletions
diff --git a/ReleaseNotes b/ReleaseNotes index 163ef6796b..7f51fe3c7a 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -12,13 +12,28 @@ Changes in version 0.2.8.12 - 2016-12-19 It also includes an updated list of fallback directories, backported from 0.2.9. - With the release of Tor 0.2.9.8, the Tor 0.2.8 series is now - officially old: only major bugfixes will be backported to 0.2.8 in the - future. - - - - + Now that the Tor 0.2.9 series is stable, only major bugfixes will be + backported to 0.2.8 in the future. + + o Major bugfixes (parsing, security, backported from 0.2.9.8): + - Fix a bug in parsing that could cause clients to read a single + byte past the end of an allocated region. This bug could be used + to cause hardened clients (built with --enable-expensive-hardening) + to crash if they tried to visit a hostile hidden service. Non- + hardened clients are only affected depending on the details of + their platform's memory allocator. Fixes bug 21018; bugfix on + 0.2.0.8-alpha. Found by using libFuzzer. Also tracked as TROVE- + 2016-12-002 and as CVE-2016-1254. + + o Minor features (fallback directory list, backported from 0.2.9.8): + - Replace the 81 remaining fallbacks of the 100 originally + introduced in Tor 0.2.8.3-alpha in March 2016, with a list of 177 + fallbacks (123 new, 54 existing, 27 removed) generated in December + 2016. Resolves ticket 20170. + + o Minor features (geoip, backported from 0.2.9.7-rc): + - Update geoip and geoip6 to the December 7 2016 Maxmind GeoLite2 + Country database. Changes in version 0.2.8.11 - 2016-12-08 |