CVE Request - tor

[Jan Lieskovsky <jlieskov () redhat com>]

Hello Steve,

  the new upstream 0.2.0.32 version of Tor has been released.
It fixes between others also two security issues:

References:
===========
http://blog.torproject.org/blog/tor-0.2.0.32-released
http://bugs.gentoo.org/show_bug.cgi?id=250018
https://svn.torproject.org/cgi-bin/viewcvs.cgi?rev=17255&view=rev
https://svn.torproject.org/cgi-bin/viewcvs.cgi?rev=17342&view=rev

Patches (against 0.2.0.32):
===========================
1, User/Group config options from Jacob Appelbaum
and Steven Murdoch (BTS 848 and 857):
https://svn.torproject.org/cgi-bin/viewcvs.cgi?rev=17255&view=rev

2, The "ClientDNSRejectInternalAddresses" config option:
Backport of R17135 against 0-2-0:  https://svn.torproject.org/cgi-bin/viewcvs.cgi?rev=17342&view=rev
Original R17135:                   https://svn.torproject.org/cgi-bin/viewcvs.cgi?rev=17135&view=rev

Affected Tor versions: x <= 0.2.0.32
======================
Checked both vulnerabilities present also in 0.1.2.17 and possibly older versions.

Could you please allocate a new CVE id(s) for these issues?

Thanks, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team