CVE-2017-16541
Publication date 4 November 2017
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected.
Status
Package | Ubuntu Release | Status |
---|---|---|
firefox | ||
20.04 LTS focal |
Not affected
|
|
18.04 LTS bionic |
Fixed 62.0+build2-0ubuntu0.18.04.3
|
|
16.04 LTS xenial |
Fixed 62.0+build2-0ubuntu0.16.04.3
|
|
14.04 LTS trusty | Not in release | |
thunderbird | ||
20.04 LTS focal |
Not affected
|
|
18.04 LTS bionic |
Fixed 1:60.2.1+build1-0ubuntu0.18.04.2
|
|
16.04 LTS xenial |
Fixed 1:60.2.1+build1-0ubuntu0.16.04.4
|
|
14.04 LTS trusty | Not in release |
Notes
Severity score breakdown
Parameter | Value |
---|---|
Base score | 6.5 · Medium |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | Required |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | None |
Availability impact | None |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
References
Other references
- https://trac.torproject.org/projects/tor/ticket/24052
- https://blog.torproject.org/tor-browser-709-released
- https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/#CVE-2017-16541
- https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/#CVE-2017-16541
- https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/#CVE-2017-16541
- https://www.cve.org/CVERecord?id=CVE-2017-16541