PT-2017-4245 · Mozilla+5 · Firefox+5

Published 2017-10-26 · Updated 2024-12-12 · CVE-2017-16541

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tor Browser versions prior to 7.0.9

Description The issue allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox. This is related to insufficient protection of service data when handling file paths.

Recommendations For Tor Browser versions prior to 7.0.9, update to version 7.0.9 or later to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2018-2304

ALT-PU-2018-2423

ALT-PU-2018-2669

BDU:2023-01948

CESA-2018_2692

CESA-2018_2693

CESA-2018_3403

CVE-2017-16541

DLA-1575-1

DSA-4327-1

MGASA-2018-0480

OPENSUSE-SU-2018:3687-1

OPENSUSE-SU-2018_2674-1

OPENSUSE-SU-2018_3051-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:10601-1

OPENSUSE-SU-2024:14572-1

RHSA-2018:2692

RHSA-2018:2693

RHSA-2018:3403

RHSA-2018:3458

RHSA-2018_2692

RHSA-2018_2693

RHSA-2018_3403

RHSA-2018_3458

SUSE-SU-2018:2890-1

SUSE-SU-2018:3247-1

SUSE-SU-2018:3591-1

SUSE-SU-2018:3591-2

SUSE-SU-2018_2890-1

SUSE-SU-2018_3591-1

SUSE-SU-2018_3591-2

Affected Products

Alt Linux

Centos

Firefox

Red Hat

Suse

Tor Browser

References · 2043

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1412081 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:3247-1 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2018-21 · Vendor Advisory
• https://blog.torproject.org/tor-browser-709-released · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2018-25/#CVE-2017-16541 · Vendor Advisory
• https://safe-surf.ru/specialists/base-vulnerabilities/619388 · Security Note
• https://security.gentoo.org/glsa/201811-13 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16541 · Security Note
• https://osv.dev/vulnerability/MGASA-2018-0480 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2018:3687-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:3591-2 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2018-19 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:3591-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10601-1 · Vendor Advisory