ByteOS Network

Vulnerability Details :

CVE-2017-16541

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-04 Nov, 2017 | 18:00

Updated At-05 Aug, 2024 | 20:27

Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:04 Nov, 2017 | 18:00

Updated At:05 Aug, 2024 | 20:27

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://trac.torproject.org/projects/tor/ticket/24052	x_refsource_MISC
https://security.gentoo.org/glsa/201810-01	vendor-advisory x_refsource_GENTOO
https://access.redhat.com/errata/RHSA-2018:2693	vendor-advisory x_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html	mailing-list x_refsource_MLIST
https://www.wearesegment.com/research/tormoil-torbrowser-unspecified-critical-security-vulnerability/	x_refsource_MISC
https://security.gentoo.org/glsa/201811-13	vendor-advisory x_refsource_GENTOO
https://www.bleepingcomputer.com/news/security/tormoil-vulnerability-leaks-real-ip-address-from-tor-browser-users/	x_refsource_MISC
https://www.debian.org/security/2018/dsa-4327	vendor-advisory x_refsource_DEBIAN
https://access.redhat.com/errata/RHSA-2018:3403	vendor-advisory x_refsource_REDHAT
https://blog.torproject.org/tor-browser-709-released	x_refsource_MISC
http://www.securitytracker.com/id/1041610	vdb-entry x_refsource_SECTRACK
http://www.securityfocus.com/bid/101665	vdb-entry x_refsource_BID
https://access.redhat.com/errata/RHSA-2018:2692	vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3458	vendor-advisory x_refsource_REDHAT
https://bugzilla.mozilla.org/show_bug.cgi?id=1412081	x_refsource_MISC

Hyperlink: https://trac.torproject.org/projects/tor/ticket/24052

Resource:

x_refsource_MISC

Hyperlink: https://security.gentoo.org/glsa/201810-01

Resource:

vendor-advisory

x_refsource_GENTOO

Hyperlink: https://access.redhat.com/errata/RHSA-2018:2693

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: https://www.wearesegment.com/research/tormoil-torbrowser-unspecified-critical-security-vulnerability/

Resource:

x_refsource_MISC

Hyperlink: https://security.gentoo.org/glsa/201811-13

Resource:

vendor-advisory

x_refsource_GENTOO

Hyperlink: https://www.bleepingcomputer.com/news/security/tormoil-vulnerability-leaks-real-ip-address-from-tor-browser-users/

Resource:

x_refsource_MISC

Hyperlink: https://www.debian.org/security/2018/dsa-4327

Resource:

vendor-advisory

x_refsource_DEBIAN

Hyperlink: https://access.redhat.com/errata/RHSA-2018:3403

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://blog.torproject.org/tor-browser-709-released

Resource:

x_refsource_MISC

Hyperlink: http://www.securitytracker.com/id/1041610

Resource:

vdb-entry

x_refsource_SECTRACK

Hyperlink: http://www.securityfocus.com/bid/101665

Resource:

vdb-entry

x_refsource_BID

Hyperlink: https://access.redhat.com/errata/RHSA-2018:2692

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://access.redhat.com/errata/RHSA-2018:3458

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://bugzilla.mozilla.org/show_bug.cgi?id=1412081

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://trac.torproject.org/projects/tor/ticket/24052	x_refsource_MISC x_transferred
https://security.gentoo.org/glsa/201810-01	vendor-advisory x_refsource_GENTOO x_transferred
https://access.redhat.com/errata/RHSA-2018:2693	vendor-advisory x_refsource_REDHAT x_transferred
https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html	mailing-list x_refsource_MLIST x_transferred
https://www.wearesegment.com/research/tormoil-torbrowser-unspecified-critical-security-vulnerability/	x_refsource_MISC x_transferred
https://security.gentoo.org/glsa/201811-13	vendor-advisory x_refsource_GENTOO x_transferred
https://www.bleepingcomputer.com/news/security/tormoil-vulnerability-leaks-real-ip-address-from-tor-browser-users/	x_refsource_MISC x_transferred
https://www.debian.org/security/2018/dsa-4327	vendor-advisory x_refsource_DEBIAN x_transferred
https://access.redhat.com/errata/RHSA-2018:3403	vendor-advisory x_refsource_REDHAT x_transferred
https://blog.torproject.org/tor-browser-709-released	x_refsource_MISC x_transferred
http://www.securitytracker.com/id/1041610	vdb-entry x_refsource_SECTRACK x_transferred
http://www.securityfocus.com/bid/101665	vdb-entry x_refsource_BID x_transferred
https://access.redhat.com/errata/RHSA-2018:2692	vendor-advisory x_refsource_REDHAT x_transferred
https://access.redhat.com/errata/RHSA-2018:3458	vendor-advisory x_refsource_REDHAT x_transferred
https://bugzilla.mozilla.org/show_bug.cgi?id=1412081	x_refsource_MISC x_transferred

Hyperlink: https://trac.torproject.org/projects/tor/ticket/24052

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://security.gentoo.org/glsa/201810-01

Resource:

vendor-advisory

x_refsource_GENTOO

x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2018:2693

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html

Resource:

mailing-list

x_refsource_MLIST

x_transferred

Hyperlink: https://www.wearesegment.com/research/tormoil-torbrowser-unspecified-critical-security-vulnerability/

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://security.gentoo.org/glsa/201811-13

Resource:

vendor-advisory

x_refsource_GENTOO

x_transferred

Hyperlink: https://www.bleepingcomputer.com/news/security/tormoil-vulnerability-leaks-real-ip-address-from-tor-browser-users/

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://www.debian.org/security/2018/dsa-4327

Resource:

vendor-advisory

x_refsource_DEBIAN

x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2018:3403

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: https://blog.torproject.org/tor-browser-709-released

Resource:

x_refsource_MISC

x_transferred

Hyperlink: http://www.securitytracker.com/id/1041610

Resource:

vdb-entry

x_refsource_SECTRACK

x_transferred

Hyperlink: http://www.securityfocus.com/bid/101665

Resource:

vdb-entry

x_refsource_BID

x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2018:2692

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2018:3458

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: https://bugzilla.mozilla.org/show_bug.cgi?id=1412081

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:04 Nov, 2017 | 18:29

Updated At:20 Apr, 2025 | 01:37

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N

Type: Primary

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:P/I:N/A:N

CPE Matches

torproject>>tor>>Versions before 7.0.9(exclusive)

cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*

Apple Inc.

>>macos>>-

cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*

Linux Kernel Organization, Inc

>>linux_kernel>>-

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_desktop>>6.0

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_desktop>>7.0

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_eus>>7.5

cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_eus>>7.6

cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_eus>>7.7

cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_server>>6.0

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_server>>7.0

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_server_aus>>7.6

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_server_aus>>7.7

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_server_tus>>7.6

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_server_tus>>7.7

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_workstation>>6.0

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_workstation>>7.0

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Debian GNU/Linux

>>debian_linux>>8.0

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Debian GNU/Linux

>>debian_linux>>9.0

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-200	Primary	nvd@nist.gov

CWE ID: CWE-200

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.securityfocus.com/bid/101665	cve@mitre.org	Broken Link
http://www.securitytracker.com/id/1041610	cve@mitre.org	Broken Link
https://access.redhat.com/errata/RHSA-2018:2692	cve@mitre.org	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2693	cve@mitre.org	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3403	cve@mitre.org	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3458	cve@mitre.org	Third Party Advisory
https://blog.torproject.org/tor-browser-709-released	cve@mitre.org	Issue Tracking Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1412081	cve@mitre.org	Exploit Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html	cve@mitre.org	Mailing List Third Party Advisory
https://security.gentoo.org/glsa/201810-01	cve@mitre.org	Third Party Advisory
https://security.gentoo.org/glsa/201811-13	cve@mitre.org	Third Party Advisory
https://trac.torproject.org/projects/tor/ticket/24052	cve@mitre.org	Issue Tracking Vendor Advisory
https://www.bleepingcomputer.com/news/security/tormoil-vulnerability-leaks-real-ip-address-from-tor-browser-users/	cve@mitre.org	Issue Tracking Third Party Advisory
https://www.debian.org/security/2018/dsa-4327	cve@mitre.org	Third Party Advisory
https://www.wearesegment.com/research/tormoil-torbrowser-unspecified-critical-security-vulnerability/	cve@mitre.org	Issue Tracking Third Party Advisory
http://www.securityfocus.com/bid/101665	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://www.securitytracker.com/id/1041610	af854a3a-2127-422b-91ae-364da2661108	Broken Link
https://access.redhat.com/errata/RHSA-2018:2692	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2693	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3403	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3458	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://blog.torproject.org/tor-browser-709-released	af854a3a-2127-422b-91ae-364da2661108	Issue Tracking Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1412081	af854a3a-2127-422b-91ae-364da2661108	Exploit Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
https://security.gentoo.org/glsa/201810-01	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://security.gentoo.org/glsa/201811-13	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://trac.torproject.org/projects/tor/ticket/24052	af854a3a-2127-422b-91ae-364da2661108	Issue Tracking Vendor Advisory
https://www.bleepingcomputer.com/news/security/tormoil-vulnerability-leaks-real-ip-address-from-tor-browser-users/	af854a3a-2127-422b-91ae-364da2661108	Issue Tracking Third Party Advisory
https://www.debian.org/security/2018/dsa-4327	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://www.wearesegment.com/research/tormoil-torbrowser-unspecified-critical-security-vulnerability/	af854a3a-2127-422b-91ae-364da2661108	Issue Tracking Third Party Advisory

Hyperlink: http://www.securityfocus.com/bid/101665

Source: cve@mitre.org

Resource:

Broken Link

Hyperlink: http://www.securitytracker.com/id/1041610

Source: cve@mitre.org

Resource:

Broken Link

Hyperlink: https://access.redhat.com/errata/RHSA-2018:2692

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2018:2693

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2018:3403

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2018:3458

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://blog.torproject.org/tor-browser-709-released

Source: cve@mitre.org

Resource:

Issue Tracking

Vendor Advisory

Hyperlink: https://bugzilla.mozilla.org/show_bug.cgi?id=1412081

Source: cve@mitre.org

Resource:

Exploit

Issue Tracking

Third Party Advisory

Hyperlink: https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html

Source: cve@mitre.org

Resource:

Mailing List

Third Party Advisory

Hyperlink: https://security.gentoo.org/glsa/201810-01

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://security.gentoo.org/glsa/201811-13

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://trac.torproject.org/projects/tor/ticket/24052

Source: cve@mitre.org

Resource:

Issue Tracking

Vendor Advisory

Hyperlink: https://www.bleepingcomputer.com/news/security/tormoil-vulnerability-leaks-real-ip-address-from-tor-browser-users/

Source: cve@mitre.org

Resource:

Issue Tracking

Third Party Advisory

Hyperlink: https://www.debian.org/security/2018/dsa-4327

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://www.wearesegment.com/research/tormoil-torbrowser-unspecified-critical-security-vulnerability/

Source: cve@mitre.org

Resource:

Issue Tracking

Third Party Advisory

Hyperlink: http://www.securityfocus.com/bid/101665