CVE-2017-11565

Name	CVE-2017-11565
Description	debian/tor.init in the Debian tor_0.2.9.11-1~deb9u1 package for Tor was designed to execute aa-exec from the standard system pathname if the apparmor package is installed, but implements this incorrectly (with a wrong assumption that the specific pathname would remain the same forever), which allows attackers to bypass intended AppArmor restrictions by leveraging the silent loss of this protection mechanism. NOTE: this does not affect systems, such as default Debian stretch installations, on which Tor startup relies on a systemd unit file (instead of this tor.init script).
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	869153

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
tor (PTS)	jessie, jessie (lts)	0.2.5.16-1	fixed
	stretch	0.2.9.16-1	vulnerable
	stretch (security), stretch (lts)	0.2.9.15-1	vulnerable
	buster (security), buster, buster (lts)	0.3.5.16-1+deb10u1	fixed
	bullseye (security), bullseye	0.4.5.16-1	fixed
	bookworm (security), bookworm	0.4.7.16-1	fixed
	sid, trixie	0.4.8.13-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
tor	source	wheezy	(not affected)
tor	source	jessie	(not affected)
tor	source	(unstable)	0.3.1.7-1	869153

Notes

[stretch] - tor <no-dsa> (Minor issue)
[jessie] - tor <not-affected> (aa-exec in jessie is located in /usr/sbin/)
[wheezy] - tor <not-affected> (aa-exec in jessie is located in /usr/sbin/)
https://twitter.com/pissquark/status/888142796414226432