CVE-2011-2778: Tor

High severity, CVSS 7.6. EPSS: 3.8% chance of exploitation in the next 30 days.

Multiple heap-based buffer overflows in Tor before 0.2.2.35 allow remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code by (1) establishing a SOCKS connection to SocksPort or (2) leveraging a SOCKS proxy configuration.

Affected products

• Tor Tor: up to and including 0.2.2.34; version 0.0.2 only; version 0.0.3 only; version 0.0.4 only; version 0.0.5 only; version 0.0.6 only; …

Published 2011-12-23. Last modified 2026-06-16.