CVE-2017-16541 — Sensitive Information Exposure in Linux

CWE-200 — Sensitive Information Exposure10 documents7 sources
Severity
6.5MEDIUMNVD
EPSS
4.5%
top 10.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
Mozilla ThunderbirdTorproject TORDebian Linux+6 more
Timeline
PublishedNov 4
Latest updateMay 13

Description

Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶NVDtorproject/tor< 7.0.9
▶Debianmozilla/thunderbird< 1:60.2.1-1+3

Also affects: Debian Linux 8.0, 9.0, Enterprise Linux 7.5, 7.6, 7.7

🔴Vulnerability Details

3
GHSA
GHSA-9348-g23j-56pf: Tor Browser before 7↗2022-05-13
▶
CVEList
CVE-2017-16541: Tor Browser before 7↗2017-11-04
▶
OSV
CVE-2017-16541: Tor Browser before 7↗2017-11-04
▶

📋Vendor Advisories

2
Red Hat
Mozilla: Proxy bypass using automount and autofs↗2017-11-03
▶
Debian
CVE-2017-16541: firefox - Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass th...↗2017
▶

💬Community

4
Bugzilla
CVE-2017-16541 tor: Anonymity feature bypass via crafted web site [epel-all]↗2017-11-08
▶
Bugzilla
CVE-2017-16541 tor: Anonymity feature bypass via crafted web site [fedora-all]↗2017-11-08
▶
Bugzilla
CVE-2017-16541 Mozilla: Proxy bypass using automount and autofs↗2017-11-08
▶
Bugzilla
(CVE-2017-16541) Proxy bypass caused by autofs on Mac, Linux↗2017-10-26
▶
CVE-2017-16541 — Sensitive Information Exposure | cvebase