Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade firefoxUpgrade thunderbirdUpgrade thunderbird-debuginfoUpgrade firefox-debuginfo | Sep 15, 2018 | Nov 4, 2017 |
| Debian | — | Upgrade thunderbirdUpgrade firefox-esr | Oct 27, 2018 | Nov 4, 2017 |
| Freebsd | — | Upgrade waterfoxUpgrade libxulUpgrade firefoxUpgrade seamonkeyUpgrade thunderbirdUpgrade firefox-esrUpgrade linux-seamonkeyUpgrade linux-thunderbirdUpgrade linux-firefox | Sep 6, 2018 | Sep 5, 2018 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird-bin.Upgrade www-client/firefox-bin.Upgrade www-client/firefox.Upgrade mail-client/thunderbird. | Oct 3, 2018 | Nov 4, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade firefox | Nov 6, 2018 | Nov 4, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade firefox | Sep 27, 2018 | Nov 4, 2017 |
| Mfsa2018 20 | — | Upgrade to Mozilla Firefox version 62.0 | Sep 6, 2018 | Nov 4, 2017 |
| Mfsa2018 21 | — | Upgrade to Mozilla Firefox ESR version 60.2 | Sep 6, 2018 | Nov 4, 2017 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 60.2.1 | Oct 5, 2018 | Nov 4, 2017 |
| Oracle Solaris | — | Upgrade web/browser/firefox to version 60.5.0-11.4.6.0.1.4.0 on Solaris 11.4Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 60.6.1-11.4.9.0.1.2.0 on Solaris 11.4Upgrade web/data/firefox-bookmarks to version 60.5.0-11.4.6.0.1.4.0 on Solaris 11.4Upgrade mail/thunderbird to version 60.6.1-11.4.9.0.1.2.0 on Solaris 11.4 | Feb 20, 2019 | Nov 4, 2017 |
| Oracle_linux | — | Upgrade thunderbirdUpgrade firefox | Nov 2, 2018 | Nov 3, 2017 |
| Redhat_linux | — | Upgrade thunderbirdUpgrade firefoxUpgrade thunderbird-debuginfoUpgrade firefox-debuginfo | Sep 13, 2018 | Nov 4, 2017 |
| Suse | — | Upgrade mozilla-nss-certsUpgrade libfreebl3-hmac-32bitUpgrade mozillathunderbird-translations-otherUpgrade mozillafirefox-buildsymbolsUpgrade libsoftokn3-hmac-32bitUpgrade libsoftokn3-hmacUpgrade libfreebl3-32bitUpgrade mozilla-nss-certs-32bitUpgrade mozilla-nssUpgrade mozilla-nss-32bitUpgrade libfreebl3-hmacUpgrade mozillafirefoxUpgrade mozillafirefox-branding-upstreamUpgrade mozillathunderbirdUpgrade mozillafirefox-translations-otherUpgrade mozillathunderbird-translations-commonUpgrade mozilla-nsprUpgrade mozilla-nss-sysinit-32bitUpgrade MozillaThunderbird-buildsymbolsUpgrade mozilla-nss-develUpgrade libsoftokn3-32bitUpgrade mozilla-nspr-32bitUpgrade mozillafirefox-translations-commonUpgrade mozillafirefox-branding-sleUpgrade mozilla-nss-sysinitUpgrade libfreebl3Upgrade apache2-mod_nssUpgrade mozilla-nspr-develUpgrade libsoftokn3Upgrade mozillafirefox-develUpgrade mozilla-nss-tools | Sep 12, 2018 | Nov 4, 2017 |
| Ubuntu | — | Upgrade firefoxUpgrade thunderbird | Nov 19, 2024 | Nov 4, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub