CVE-2011-0427 [Medium] | Memory Corruption in Tor

CVE-2011-0427 is rated Moderate Risk (59.7/100): CVSS Medium severity, with high exploitation likelihood (EPSS 5.92%, 90th percentile). EPSS ranks this CVE among the most likely to be exploited in the near term. High exploitation likelihood—assess exposure and prioritize remediation.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2025-07-21	4.94%	5.92%	+0.98%
2	2025-03-30	5.57%	4.94%	-0.64%
3	2025-03-29	—	5.57%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2025-07-21

4.94%

5.92%

+0.98%

2025-03-30

5.57%

4.94%

-0.64%

2025-03-29

—

5.57%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
6.8	2.0	MEDIUM	`AV:N/AC:M/Au:N/C:P/I:P/A:P` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:M) Exploitation needs some favorable conditions, but not exceptional ones. Authentication (AU:N) No authentication is required. Confidentiality impact (C:P) Partial confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:P) Partial availability impact.	8.6	6.4	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

6.8

2.0

MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:P Click to expand

Access vector (AV:N): Can be exploited remotely over network reachability.
Access complexity (AC:M): Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N): No authentication is required.
Confidentiality impact (C:P): Partial confidentiality impact.
Integrity impact (I:P): Partial integrity impact.
Availability impact (A:P): Partial availability impact.

8.6

6.4

[email protected]

OS Trackers for CVE-2011-0427

vendor	priority	summary	link
`debian`	not yet assigned	CVE-2011-0427 not yet assigned priority: Debian including 1 source packages (tor), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2011-0427
`gentoo`	high	CVE-2011-0427: 1 GLSA(s) (201110-13), 1 atom(s) (net-misc/tor); latest impact high.	https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2011-0427
`ubuntu`	medium	CVE-2011-0427 medium priority: Ubuntu including 1 source packages (tor), 8 status rows across 8 suites (dapper, hardy, karmic, lucid, maverick, natty, oneiric, upstream): DNE 3, ignored 2, not-affected 2, released 1.	https://ubuntu.com/security/CVE-2011-0427

Affected software / configurations for CVE-2011-0427

Vendor	Product	Version	Raw CPE
tor	tor	<= 0.2.1.28	cpe:2.3:a:tor:tor::::::::
tor	tor	0.0.2	cpe:2.3:a:tor:tor:0.0.2:::::::*
tor	tor	0.0.2_pre13	cpe:2.3:a:tor:tor:0.0.2_pre13:::::::*
tor	tor	0.0.2_pre14	cpe:2.3:a:tor:tor:0.0.2_pre14:::::::*
tor	tor	0.0.2_pre15	cpe:2.3:a:tor:tor:0.0.2_pre15:::::::*
tor	tor	0.0.2_pre16	cpe:2.3:a:tor:tor:0.0.2_pre16:::::::*
tor	tor	0.0.2_pre17	cpe:2.3:a:tor:tor:0.0.2_pre17:::::::*
tor	tor	0.0.2_pre18	cpe:2.3:a:tor:tor:0.0.2_pre18:::::::*
tor	tor	0.0.2_pre19	cpe:2.3:a:tor:tor:0.0.2_pre19:::::::*
tor	tor	0.0.2_pre20	cpe:2.3:a:tor:tor:0.0.2_pre20:::::::*
tor	tor	0.0.2_pre21	cpe:2.3:a:tor:tor:0.0.2_pre21:::::::*
tor	tor	0.0.2_pre22	cpe:2.3:a:tor:tor:0.0.2_pre22:::::::*
tor	tor	0.0.2_pre23	cpe:2.3:a:tor:tor:0.0.2_pre23:::::::*
tor	tor	0.0.2_pre24	cpe:2.3:a:tor:tor:0.0.2_pre24:::::::*
tor	tor	0.0.2_pre25	cpe:2.3:a:tor:tor:0.0.2_pre25:::::::*
tor	tor	0.0.2_pre26	cpe:2.3:a:tor:tor:0.0.2_pre26:::::::*
tor	tor	0.0.2_pre27	cpe:2.3:a:tor:tor:0.0.2_pre27:::::::*
tor	tor	0.0.3	cpe:2.3:a:tor:tor:0.0.3:::::::*
tor	tor	0.0.4	cpe:2.3:a:tor:tor:0.0.4:::::::*
tor	tor	0.0.5	cpe:2.3:a:tor:tor:0.0.5:::::::*
tor	tor	0.0.6	cpe:2.3:a:tor:tor:0.0.6:::::::*
tor	tor	0.0.6.1	cpe:2.3:a:tor:tor:0.0.6.1:::::::*
tor	tor	0.0.6.2	cpe:2.3:a:tor:tor:0.0.6.2:::::::*
tor	tor	0.0.7	cpe:2.3:a:tor:tor:0.0.7:::::::*
tor	tor	0.0.7.1	cpe:2.3:a:tor:tor:0.0.7.1:::::::*
tor	tor	0.0.7.2	cpe:2.3:a:tor:tor:0.0.7.2:::::::*
tor	tor	0.0.7.3	cpe:2.3:a:tor:tor:0.0.7.3:::::::*
tor	tor	0.0.8	cpe:2.3:a:tor:tor:0.0.8:::::::*
tor	tor	0.0.8.1	cpe:2.3:a:tor:tor:0.0.8.1:::::::*
tor	tor	0.0.9	cpe:2.3:a:tor:tor:0.0.9:::::::*
tor	tor	0.0.9.1	cpe:2.3:a:tor:tor:0.0.9.1:::::::*
tor	tor	0.0.9.2	cpe:2.3:a:tor:tor:0.0.9.2:::::::*
tor	tor	0.0.9.3	cpe:2.3:a:tor:tor:0.0.9.3:::::::*
tor	tor	0.0.9.4	cpe:2.3:a:tor:tor:0.0.9.4:::::::*
tor	tor	0.0.9.5	cpe:2.3:a:tor:tor:0.0.9.5:::::::*
tor	tor	0.0.9.6	cpe:2.3:a:tor:tor:0.0.9.6:::::::*
tor	tor	0.0.9.7	cpe:2.3:a:tor:tor:0.0.9.7:::::::*
tor	tor	0.0.9.8	cpe:2.3:a:tor:tor:0.0.9.8:::::::*
tor	tor	0.0.9.9	cpe:2.3:a:tor:tor:0.0.9.9:::::::*
tor	tor	0.0.9.10	cpe:2.3:a:tor:tor:0.0.9.10:::::::*
tor	tor	0.1.0.1	cpe:2.3:a:tor:tor:0.1.0.1:::::::*
tor	tor	0.1.0.2	cpe:2.3:a:tor:tor:0.1.0.2:::::::*
tor	tor	0.1.0.3	cpe:2.3:a:tor:tor:0.1.0.3:::::::*
tor	tor	0.1.0.4	cpe:2.3:a:tor:tor:0.1.0.4:::::::*
tor	tor	0.1.0.5	cpe:2.3:a:tor:tor:0.1.0.5:::::::*
tor	tor	0.1.0.6	cpe:2.3:a:tor:tor:0.1.0.6:::::::*
tor	tor	0.1.0.7	cpe:2.3:a:tor:tor:0.1.0.7:::::::*
tor	tor	0.1.0.8	cpe:2.3:a:tor:tor:0.1.0.8:::::::*
tor	tor	0.1.0.9	cpe:2.3:a:tor:tor:0.1.0.9:::::::*
tor	tor	0.1.0.10	cpe:2.3:a:tor:tor:0.1.0.10:::::::*
tor	tor	0.1.0.11	cpe:2.3:a:tor:tor:0.1.0.11:::::::*
tor	tor	0.1.0.12	cpe:2.3:a:tor:tor:0.1.0.12:::::::*
tor	tor	0.1.0.13	cpe:2.3:a:tor:tor:0.1.0.13:::::::*
tor	tor	0.1.0.14	cpe:2.3:a:tor:tor:0.1.0.14:::::::*
tor	tor	0.1.0.15	cpe:2.3:a:tor:tor:0.1.0.15:::::::*
tor	tor	0.1.0.16	cpe:2.3:a:tor:tor:0.1.0.16:::::::*
tor	tor	0.1.0.17	cpe:2.3:a:tor:tor:0.1.0.17:::::::*
tor	tor	0.1.1	cpe:2.3:a:tor:tor:0.1.1:::::::*
tor	tor	0.1.1.1	cpe:2.3:a:tor:tor:0.1.1.1:::::::*
tor	tor	0.1.1.1	cpe:2.3:a:tor:tor:0.1.1.1:alpha::::::
tor	tor	0.1.1.2	cpe:2.3:a:tor:tor:0.1.1.2:::::::*
tor	tor	0.1.1.2	cpe:2.3:a:tor:tor:0.1.1.2:alpha::::::
tor	tor	0.1.1.3	cpe:2.3:a:tor:tor:0.1.1.3:::::::*
tor	tor	0.1.1.3	cpe:2.3:a:tor:tor:0.1.1.3:alpha::::::
tor	tor	0.1.1.4	cpe:2.3:a:tor:tor:0.1.1.4:::::::*
tor	tor	0.1.1.4	cpe:2.3:a:tor:tor:0.1.1.4:alpha::::::
tor	tor	0.1.1.5	cpe:2.3:a:tor:tor:0.1.1.5:::::::*
tor	tor	0.1.1.5	cpe:2.3:a:tor:tor:0.1.1.5:alpha::::::
tor	tor	0.1.1.6	cpe:2.3:a:tor:tor:0.1.1.6:::::::*
tor	tor	0.1.1.6	cpe:2.3:a:tor:tor:0.1.1.6:alpha::::::
tor	tor	0.1.1.7	cpe:2.3:a:tor:tor:0.1.1.7:::::::*
tor	tor	0.1.1.7	cpe:2.3:a:tor:tor:0.1.1.7:alpha::::::
tor	tor	0.1.1.8	cpe:2.3:a:tor:tor:0.1.1.8:::::::*
tor	tor	0.1.1.8	cpe:2.3:a:tor:tor:0.1.1.8:alpha::::::
tor	tor	0.1.1.9	cpe:2.3:a:tor:tor:0.1.1.9:::::::*
tor	tor	0.1.1.9	cpe:2.3:a:tor:tor:0.1.1.9:alpha::::::
tor	tor	0.1.1.10	cpe:2.3:a:tor:tor:0.1.1.10:::::::*
tor	tor	0.1.1.10	cpe:2.3:a:tor:tor:0.1.1.10:alpha::::::
tor	tor	0.1.1.11	cpe:2.3:a:tor:tor:0.1.1.11:::::::*
tor	tor	0.1.1.12	cpe:2.3:a:tor:tor:0.1.1.12:::::::*

References for CVE-2011-0427

URL	Tags
http://archives.seul.org/or/announce/Jan-2011/msg00000.html	Patch
http://blog.torproject.org/blog/tor-02129-released-security-patches	Patch Vendor Advisory
http://secunia.com/advisories/42905	Vendor Advisory
http://secunia.com/advisories/42907	Vendor Advisory
http://www.debian.org/security/2011/dsa-2148
http://www.securityfocus.com/bid/45832
http://www.securitytracker.com/id?1024980
http://www.vupen.com/english/advisories/2011/0131	Vendor Advisory
http://www.vupen.com/english/advisories/2011/0132	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/64748
https://gitweb.torproject.org/tor.git/blob/refs/heads/release-0.2.2:/ChangeLog	Patch

URL

CVE-2011-0427

Exploit prediction scoring system (EPSS) score for CVE-2011-0427

Common vulnerability scoring system (CVSS) metrics for CVE-2011-0427

Weakness enumeration for CVE-2011-0427

OS Trackers for CVE-2011-0427

Affected software / configurations for CVE-2011-0427

References for CVE-2011-0427