Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade firefoxUpgrade thunderbirdUpgrade thunderbird-debuginfoUpgrade firefox-debuginfo | Sep 15, 2018 | Nov 4, 2017 |
| Debian | — | Upgrade firefox-esrUpgrade thunderbird | Oct 27, 2018 | Nov 4, 2017 |
| Freebsd | — | Upgrade libxulUpgrade seamonkeyUpgrade firefoxUpgrade waterfoxUpgrade linux-seamonkeyUpgrade linux-thunderbirdUpgrade firefox-esrUpgrade thunderbirdUpgrade linux-firefox | Sep 6, 2018 | Sep 5, 2018 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird.Upgrade www-client/firefox.Upgrade mail-client/thunderbird-bin.Upgrade www-client/firefox-bin. | Oct 3, 2018 | Nov 4, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade firefox | Nov 6, 2018 | Nov 4, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade firefox | Sep 27, 2018 | Nov 4, 2017 |
| Mfsa2018 20 | — | Upgrade to Mozilla Firefox version 62.0 | Sep 6, 2018 | Nov 4, 2017 |
| Mfsa2018 21 | — | Upgrade to Mozilla Firefox ESR version 60.2 | Sep 6, 2018 | Nov 4, 2017 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 60.2.1 | Oct 5, 2018 | Nov 4, 2017 |
| Oracle Solaris | — | Upgrade web/browser/firefox to version 60.5.0-11.4.6.0.1.4.0 on Solaris 11.4Upgrade web/data/firefox-bookmarks to version 60.5.0-11.4.6.0.1.4.0 on Solaris 11.4Upgrade mail/thunderbird to version 60.6.1-11.4.9.0.1.2.0 on Solaris 11.4Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 60.6.1-11.4.9.0.1.2.0 on Solaris 11.4 | Feb 20, 2019 | Nov 4, 2017 |
| Oracle_linux | — | Upgrade thunderbirdUpgrade firefox | Nov 2, 2018 | Nov 3, 2017 |
| Redhat_linux | — | Upgrade thunderbird-debuginfoUpgrade firefox-debuginfoUpgrade firefoxUpgrade thunderbird | Sep 13, 2018 | Nov 4, 2017 |
| Suse | — | Upgrade mozilla-nspr-32bitUpgrade mozillafirefox-translations-otherUpgrade libsoftokn3-32bitUpgrade libfreebl3Upgrade mozilla-nss-toolsUpgrade mozilla-nss-develUpgrade mozilla-nss-sysinit-32bitUpgrade mozilla-nspr-develUpgrade MozillaThunderbird-buildsymbolsUpgrade libsoftokn3Upgrade mozillafirefox-branding-sleUpgrade apache2-mod_nssUpgrade mozillafirefox-develUpgrade mozilla-nsprUpgrade mozillathunderbird-translations-commonUpgrade mozillafirefox-translations-commonUpgrade mozilla-nss-sysinitUpgrade libfreebl3-hmacUpgrade mozilla-nss-32bitUpgrade mozilla-nss-certsUpgrade libfreebl3-32bitUpgrade mozillathunderbird-translations-otherUpgrade mozillafirefox-buildsymbolsUpgrade libfreebl3-hmac-32bitUpgrade mozilla-nss-certs-32bitUpgrade mozillafirefox-branding-upstreamUpgrade libsoftokn3-hmac-32bitUpgrade mozillathunderbirdUpgrade libsoftokn3-hmacUpgrade mozilla-nssUpgrade mozillafirefox | Sep 12, 2018 | Nov 4, 2017 |
| Ubuntu | — | Upgrade thunderbirdUpgrade firefox | Nov 19, 2024 | Nov 4, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub