Softpedia >Windows >Network Tools >Misc. Networking Tools >Vidalia Bundle >  Changelog

Vidalia Bundle Changelog

What's new in Vidalia Bundle 0.2.4.19

Dec 20, 2013
  • Don't wait so long before attempting to reload the router list if the ns/all command returned empty. Fixes bug 6483.
  • Stop trying to load router information if torControl is not connected anymore. Fixes bug 6482.
  • Save ControlPortWriteToFile with a relative path instead of an absolute one. Fixes bug 6568.
  • Fix RouterDescriptor's bandwidth and uptime values when defined from the consensus. Fixes bug 6601.

New in Vidalia Bundle 0.2.4.12 Alpha (Apr 30, 2013)

  • Update Tor to 0.2.4.12-alpha
  • Update Torbutton to 1.5.2
  • Update libpng to 1.5.15
  • Update NoScript to 2.6.6
  • Update PDF.js to 0.8.1
  • Firefox patch changes:
  • Apply font limits to @font-face local() fonts and disable fallback
  • rendering for @font-face. (closes: #8455)
  • Use Optimistic Data SOCKS handshake (improves page load performance).
  • closes: #3875)
  • Honor the Windows theme for inverse text colors (without leaking those
  • colors to content). (closes: #7920)
  • Increase pipeline randomization and try harder to batch pipelined
  • requests together. (closes: #8470)
  • Fix an image cache isolation domain key misusage. May fix several image
  • cache related crash bugs with New Identity, exit, and certain websites.
  • closes: #8628)
  • Torbutton changes:
  • Allow session restore if the user allows disk actvity (closes: #8457)
  • Remove the Display Settings panel and associated locales (closes: #8301)
  • Fix "Transparent Torification" option. (closes: #6566)
  • Fix a hang on New Identity. (closes: #8642)
  • Build changes:
  • Fetch our source deps from an https mirror (closes: #8286)
  • Create watch scripts for syncing mirror sources and monitoring mirror
  • integrity (closes: #8338)

New in Vidalia Bundle 0.2.4.11 Alpha (Apr 7, 2013)

  • Update Firefox to 17.0.5esr
  • Update NoScript to 2.6.59

New in Vidalia Bundle 0.2.4.10 Alpha (Feb 22, 2013)

  • Update Firefox to 17.0.3esr
  • Downgrade OpenSSL to 1.0.0k
  • Update libpng to 1.5.14
  • Update NoScript to 2.6.5.7
  • Firefox patch changes:
  • Exempt remote @font-face fonts from font limits (and prefer them):
  • Remote fonts (aka "User Fonts") are not a fingerprinting threat, so they should not count towards our CSS font count limits. Moreover, if a CSS font-family rule lists any remote fonts, those fonts are preferred over the local fonts, so we do not reduce the font count for that rule.
  • This vastly improves rendering and typography for many websites.
  • Disable WebRTC in Firefox build options. (closes: #8178)
  • WebRTC isn't slated to be enabled until Firefox 18, but the code was getting compiled in already and is capable of creating UDP Sockets and bypassing Tor. We disable it from build as a safety measure.
  • Move prefs.js into omni.ja and extension-overrides. (closes: #3944)
  • This causes our browser pref changes to appear as defaults. It also means that future updates of TBB should preserve user pref settings.
  • Fix a use-after-free that caused crashing on MacOS (closes: #8234)
  • Eliminate several redundant, useless, and deprecated Firefox pref settings
  • Report Firefox 17.0 as the Tor Browser user agent
  • Use Firefox's click-to-play barrier for plugins instead of NoScript
  • Set the Tor SOCKS+Control ports to 9150, 9151 respectively on all platforms:
  • This fixes a SOCKS race condition with our SOCKS autoport configuration
  • and HTTPS-Everywhere's Tor test. Firefox 17 appears to cache proxy settings per URL now, which resulted in a proxy error for check.torproject.org if we lost the race.
  • Torbutton was updated to 1.5.0. The following issues were fixed:
  • Remove old toggle observers and related code (closes: #5279)
  • Simplify Security Preference UI and associated pref updates (closes: #3100)
  • Eliminate redundancy in our Flash/plugin disabling code (closes: #7470)
  • Leave most preferences under Tor Browser's control (closes: #3944)
  • Disable toggle-on-startup and crash detection logic (closes: #7974)
  • Disable/remove toggle-mode code and related observers (closes: #5379)
  • Add menu hint to Torbutton icon (closes: #6431)
  • Make Torbutton icon flash a warning symbol if TBB is out of date (closes: #7495)
  • Perform version check every time there's a new tab. (closes: #6096)
  • Rate limit version check queries to once every 1.5hrs max. (closes: #6156)
  • misc: Allow WebGL and DOM storage.
  • misc: Disable independent Torbutton updates
  • misc: Change the recommended SOCKSPort to 9150 (to match TBB)

New in Vidalia Bundle 0.2.4.7 Alpha (Jan 7, 2013)

  • Update Firefox to 10.0.12esr
  • Update Tor to 0.2.4.7-alpha
  • Update Libevent to 2.0.21-stable
  • Update HTTPS Everywhere to 4.0development.4
  • Update NoScript to 2.6.4.2

New in Vidalia Bundle 0.2.3.25 (Jan 7, 2013)

  • Update Firefox to 10.0.12esr
  • Update Libevent to 2.0.21-stable
  • Update HTTPS Everywhere to 3.1.2
  • Update NoScript to 2.6.4.2

New in Vidalia Bundle 0.2.2.36 (Jun 5, 2012)

  • Directory authority changes:
  • Change IP address for maatuska (v3 directory authority).
  • Change IP address for ides (v3 directory authority), and rename it to turtles.
  • Security fixes:
  • When building or running with any version of OpenSSL earlier than 0.9.8s or 1.0.0f, disable SSLv3 support. These OpenSSL versions have a bug (CVE-2011-4576) in which their block cipher padding includes uninitialized data, potentially leaking sensitive information to any peer with whom they make a SSLv3 connection. Tor does not use SSL v3 by default, but a hostile client or server could force an SSLv3 connection in order to gain information that they shouldn't have been able to get. The best solution here is to upgrade to OpenSSL 0.9.8s or 1.0.0f (or later). But when building or running with a non-upgraded OpenSSL, we disable SSLv3 entirely to make sure that the bug can't happen.
  • Never use a bridge or a controller-supplied node as an exit, even if its exit policy allows it. Found by wanoskarnet. Fixes bug 5342. Bugfix on 0.1.1.15-rc (for controller-purpose descriptors) and 0.2.0.3-alpha (for bridge-purpose descriptors).
  • Only build circuits if we have a sufficient threshold of the total descriptors that are marked in the consensus with the "Exit" flag. This mitigates an attack proposed by wanoskarnet, in which all of a client's bridges collude to restrict the exit nodes that the client knows about. Fixes bug 5343.
  • Provide controllers with a safer way to implement the cookie authentication mechanism. With the old method, if another locally running program could convince a controller that it was the Tor process, then that program could trick the contoller into telling it the contents of an arbitrary 32-byte file. The new "SAFECOOKIE" authentication method uses a challenge-response approach to prevent this attack. Fixes bug 5185; implements proposal 193.
  • Major bugfixes:
  • Avoid logging uninitialized data when unable to decode a hidden service descriptor cookie. Fixes bug 5647; bugfix on 0.2.1.5-alpha.
  • Avoid a client-side assertion failure when receiving an INTRODUCE2 cell on a general purpose circuit. Fixes bug 5644; bugfix on 0.2.1.6-alpha.
  • Fix builds when the path to sed, openssl, or sha1sum contains spaces, which is pretty common on Windows. Fixes bug 5065; bugfix on 0.2.2.1-alpha.
  • Correct our replacements for the timeradd() and timersub() functions on platforms that lack them (for example, Windows). The timersub() function is used when expiring circuits, while timeradd() is currently unused. Bug report and patch by Vektor. Fixes bug 4778; bugfix on 0.2.2.24-alpha.
  • Fix the SOCKET_OK test that we use to tell when socket creation fails so that it works on Win64. Fixes part of bug 4533; bugfix on 0.2.2.29-beta. Bug found by wanoskarnet.
  • Minor bugfixes:
  • Reject out-of-range times like 23:59:61 in parse_rfc1123_time().
  • Fixes bug 5346; bugfix on 0.0.8pre3.
  • Make our number-parsing functions always treat too-large values as an error, even when those values exceed the width of the underlying type. Previously, if the caller provided these functions with minima or maxima set to the extreme values of the underlying integer type, these functions would return those values on overflow rather than treating overflow as an error.
  • Fixes part of bug 5786; bugfix on 0.0.9.
  • Older Linux kernels erroneously respond to strange nmap behavior by having accept() return successfully with a zero-length socket. When this happens, just close the connection. Previously, we would try harder to learn the remote address: but there was no such remote address to learn, and our method for trying to learn it was incorrect. Fixes bugs 1240, 4745, and 4747. Bugfix on 0.1.0.3-rc. Reported and diagnosed by "r1eo".
  • Correct parsing of certain date types in parse_http_time().
  • Without this patch, If-Modified-Since would behave incorrectly. Fixes bug 5346; bugfix on 0.2.0.2-alpha. Patch from Esteban Manchado Velázques.
  • Change the BridgePassword feature (part of the "bridge community" design, which is not yet implemented) to use a time-independent comparison. The old behavior might have allowed an adversary to use timing to guess the BridgePassword value. Fixes bug 5543; bugfix on 0.2.0.14-alpha.
  • Detect and reject certain misformed escape sequences in configuration values. Previously, these values would cause us to crash if received in a torrc file or over an authenticated control port. Bug found by Esteban Manchado Velázquez, and independently by Robert Connolly from Matta Consulting who further noted that it allows a post-authentication heap overflow. Patch
  • by Alexander Schrijver. Fixes bugs 5090 and 5402 (CVE 2012-1668); bugfix on 0.2.0.16-alpha.
  • Fix a compile warning when using the --enable-openbsd-malloc configure option. Fixes bug 5340; bugfix on 0.2.0.20-rc.
  • During configure, detect when we're building with clang version 3.0 or lower and disable the -Wnormalized=id and -Woverride-init CFLAGS. clang doesn't support them yet.
  • When sending an HTTP/1.1 proxy request, include a Host header. Fixes bug 5593; bugfix on 0.2.2.1-alpha.
  • Fix a NULL-pointer dereference on a badly formed SETCIRCUITPURPOSE command. Found by mikeyc. Fixes bug 5796; bugfix on 0.2.2.9-alpha.
  • If we hit the error case where routerlist_insert() replaces an existing (old) server descriptor, make sure to remove that server descriptor from the old_routers list. Fix related to bug 1776. Bugfix on 0.2.2.18-alpha.
  • Minor bugfixes (documentation and log messages):
  • Fix a typo in a log message in rend_service_rendezvous_has_opened(). Fixes bug 4856; bugfix on Tor 0.0.6.
  • Update "ClientOnly" man page entry to explain that there isn't really any point to messing with it. Resolves ticket 5005.
  • Document the GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays
  • directory authority option (introduced in Tor 0.2.2.34).
  • Downgrade the "We're missing a certificate" message from notice to info: people kept mistaking it for a real problem, whereas it is seldom the problem even when we are failing to bootstrap. Fixes bug 5067; bugfix on 0.2.0.10-alpha.
  • Correctly spell "connect" in a log message on failure to create a controlsocket. Fixes bug 4803; bugfix on 0.2.2.26-beta.
  • Clarify the behavior of MaxCircuitDirtiness with hidden service circuits. Fixes issue 5259.
  • Minor features:
  • Directory authorities now reject versions of Tor older than 0.2.1.30, and Tor versions between 0.2.2.1-alpha and 0.2.2.20-alpha inclusive. These versions accounted for only a small fraction of the Tor network, and have numerous known security issues. Resolves issue 4788.
  • Update to the May 1 2012 Maxmind GeoLite Country database.
  • Feature removal:
  • When sending or relaying a RELAY_EARLY cell, we used to convert it to a RELAY cell if the connection was using the v1 link protocol. This was a workaround for older versions of Tor, which didn't handle RELAY_EARLY cells properly. Now that all supported versions can handle RELAY_EARLY cells, and now that we're enforcing the "no RELAY_EXTEND commands except in RELAY_EARLY cells" rule, remove this workaround. Addresses bug 4786.

New in Vidalia Bundle 0.2.3.10 Alpha (Dec 17, 2011)

  • Major bugfixes:
  • Fix a heap overflow bug that could occur when trying to pull data into the first chunk of a buffer, when that chunk had already had some data drained from it. Fixes CVE-2011-2778; bugfix on 0.2.0.16-alpha. Reported by "Vektor".
  • Minor bugfixes:
  • If we can't attach streams to a rendezvous circuit when we finish connecting to a hidden service, clear the rendezvous circuit's stream-isolation state and try to attach streams again. Previously, we cleared rendezvous circuits' isolation state either too early (if they were freshly built) or not at all (if they had been built earlier and were cannibalized). Bugfix on 0.2.3.3-alpha; fixes bug 4655.
  • Fix compilation of the libnatpmp helper on non-Windows. Bugfix on 0.2.3.9-alpha; fixes bug 4691. Reported by Anthony G. Basile.
  • Fix an assertion failure when a relay with accounting enabled starts up while dormant. Fixes bug 4702; bugfix on 0.2.3.9-alpha.
  • Minor features:
  • Update to the December 6 2011 Maxmind GeoLite Country database.

New in Vidalia Bundle 0.2.2.35 (Dec 17, 2011)

  • Major bugfixes:
  • Fix a heap overflow bug that could occur when trying to pull data into the first chunk of a buffer, when that chunk had already had some data drained from it. Fixes CVE-2011-2778; bugfix on 0.2.0.16-alpha. Reported by "Vektor".
  • Initialize Libevent with the EVENT_BASE_FLAG_NOLOCK flag enabled, so that it doesn't attempt to allocate a socketpair. This could cause some problems on Windows systems with overzealous firewalls. Fix for bug 4457; workaround for Libevent versions 2.0.1-alpha through 2.0.15-stable.
  • If we mark an OR connection for close based on a cell we process, don't process any further cells on it. We already avoid further reads on marked-for-close connections, but now we also discard the cells we'd already read. Fixes bug 4299; bugfix on 0.2.0.10-alpha, which was the first version where we might mark a connection for close based on processing a cell on it.
  • Correctly sanity-check that we don't underflow on a memory allocation (and then assert) for hidden service introduction point decryption. Bug discovered by Dan Rosenberg. Fixes bug 4410; bugfix on 0.2.1.5-alpha.
  • Fix a memory leak when we check whether a hidden service descriptor has any usable introduction points left. Fixes bug 4424. Bugfix on 0.2.2.25-alpha.
  • Don't crash when we're running as a relay and don't have a GeoIP file. Bugfix on 0.2.2.34; fixes bug 4340. This backports a fix we've had in the 0.2.3.x branch already.
  • When running as a client, do not print a misleading (and plain wrong) log message that we're collecting "directory request" statistics: clients don't collect statistics. Also don't create a useless (because empty) stats file in the stats/ directory. Fixes bug 4353; bugfix on 0.2.2.34.
  • Minor bugfixes:
  • Detect failure to initialize Libevent. This fix provides better detection for future instances of bug 4457.
  • Avoid frequent calls to the fairly expensive cull_wedged_cpuworkers function. This was eating up hideously large amounts of time on some busy servers. Fixes bug 4518; bugfix on 0.0.9.8.
  • Resolve an integer overflow bug in smartlist_ensure_capacity(). Fixes bug 4230; bugfix on Tor 0.1.0.1-rc. Based on a patch by Mansour Moufid.
  • Don't warn about unused log_mutex in log.c when building with --disable-threads using a recent GCC. Fixes bug 4437; bugfix on 0.1.0.6-rc which introduced --disable-threads.
  • When configuring, starting, or stopping an NT service, stop immediately after the service configuration attempt has succeeded or failed. Fixes bug 3963; bugfix on 0.2.0.7-alpha.
  • When sending a NETINFO cell, include the original address received for the other side, not its canonical address. Found by "troll_un"; fixes bug 4349; bugfix on 0.2.0.10-alpha.
  • Fix a typo in a hibernation-related log message. Fixes bug 4331; bugfix on 0.2.2.23-alpha; found by "tmpname0901".
  • Fix a memory leak in launch_direct_bridge_descriptor_fetch() that occurred when a client tried to fetch a descriptor for a bridge in ExcludeNodes. Fixes bug 4383; bugfix on 0.2.2.25-alpha.
  • Backport fixes for a pair of compilation warnings on Windows. Fixes bug 4521; bugfix on 0.2.2.28-beta and on 0.2.2.29-beta.
  • If we had ever tried to call tor_addr_to_str on an address of unknown type, we would have done a strdup on an uninitialized buffer. Now we won't. Fixes bug 4529; bugfix on 0.2.1.3-alpha. Reported by "troll_un".
  • Correctly detect and handle transient lookup failures from tor_addr_lookup. Fixes bug 4530; bugfix on 0.2.1.5-alpha. Reported by "troll_un".
  • Fix null-pointer access that could occur if TLS allocation failed. Fixes bug 4531; bugfix on 0.2.0.20-rc. Found by "troll_un".
  • Use tor_socket_t type for listener argument to accept(). Fixes bug 4535; bugfix on 0.2.2.28-beta. Found by "troll_un".
  • Minor features:
  • Add two new config options for directory authorities: AuthDirFastGuarantee sets a bandwidth threshold for guaranteeing the Fast flag, and AuthDirGuardBWGuarantee sets a bandwidth threshold that is always sufficient to satisfy the bandwidth requirement for the Guard flag. Now it will be easier for researchers to simulate Tor networks with different values. Resolves ticket 4484.
  • When Tor ignores a hidden service specified in its configuration, include the hidden service's directory in the warning message. Previously, we would only tell the user that some hidden service was ignored. Bugfix on 0.0.6; fixes bug 4426.
  • Update to the December 6 2011 Maxmind GeoLite Country database.
  • Packaging changes:
  • Make it easier to automate expert package builds on Windows, by removing an absolute path from makensis.exe command.

New in Vidalia Bundle 0.2.7 Dev (Mar 1, 2010)

  • Remove the explicit palette set for the configuration dialog that prevented the dialog from inheriting colors from the user's current system theme.
  • Correct the path to the badge pixmap used in time skew warning messages.
  • Fix compilation on Debian GNU/kFreeBSD.
  • Clean up a couple status event messages related to dangerous port warnings.
  • Change the vidalia_ru.nsh output encoding from KOI8-R to Windows-1251.

New in Vidalia Bundle 0.2.6 Dev (Nov 26, 2009)

  • Updated the Arabic, Russian and Slovenian translations.

New in Vidalia Bundle 0.2.4 Dev (Sep 10, 2009)

  • Split the message log into "Basic" and "Advanced" views. The "Advanced" view contains standard log messages from Tor, while the new experimental "Basic" view displays status events received from Tor. (Ticket #265)
  • Fix a bug introduced in 0.2.3 that prevented Vidalia from correctly responding to ADDRMAP events from Tor. The result was that users would sometimes see IP addresses in the connection list shown under the network map rather than hostnames.

New in Vidalia Bundle 0.1.15 (Sep 10, 2009)

  • Bump the minimum required Qt version to 4.3.0.
  • Remove USE_QSSLSOCKET as a build option. If your Qt doesn't support !OpenSSL, then you don't get GeoIP lookups.
  • Include libeay32.dll in the Windows installers.

New in Vidalia Bundle 0.1.10 (Mar 9, 2009)

  • Add a prettier dialog for prompting people for their control port password that also includes a checkbox for whether the user wants Vidalia to remember the entered password, a Help button, and a Reset button (Windows only).
  • Fix a crash bug that occurred when the user clicks 'Clear' in the message log toolbar followed by 'Save All'. (Ticket #434)
  • Uncheck the Torbutton options by default in the Windows bundle installer if Firefox is not installed. (Ticket #421)
  • Add an Windows bundle installer page that warns the user that they should install Firefox, if it looks like they haven't already done so. (Ticket #421)