CVE-2012-3518: Tor

Medium severity, CVSS 5.0. EPSS: 2.8% chance of exploitation in the next 30 days.

The networkstatus_parse_vote_from_string function in routerparse.c in Tor before 0.2.2.38 does not properly handle an invalid flavor name, which allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted (1) vote document or (2) consensus document.

Affected products

• Tor Tor: up to and including 0.2.2.37

Published 2012-08-26. Last modified 2026-06-16.