CVE-2017-16541 (NVD)

2017-11-04

Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected.

Products Debian_linux, Enterprise_linux_desktop, Enterprise_linux_eus, Enterprise_linux_server, Enterprise_linux_server_aus, Enterprise_linux_server_tus, Enterprise_linux_workstation, Tor
Type Information Exposure (CWE-200)
First patch - None (likely due to unavailable code)
Links • https://access.redhat.com/errata/RHSA-2018:2692
• https://access.redhat.com/errata/RHSA-2018:2693
• https://security.gentoo.org/glsa/201810-01
• https://security.gentoo.org/glsa/201811-13
• https://bugzilla.mozilla.org/show_bug.cgi?id=1412081