CVE-2017-16541

MEDIUM 6.5CVE-2017-16541 · Published 04/11/2017 · updated 17/06/2026

In short

CVE-2017-16541 is a MEDIUM (CVSS 6.5) vulnerability affecting tor (torproject).
Chance of exploitation in the next 30 days (EPSS): 3.7%, higher than 89.6% of all vulnerabilities.
Fix: update to 7.0.9 or later.

Package	Affected versions	Patched versions
tor torproject	`< 7.0.9`	`7.0.9`

Description

Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected.

References

securityfocus.com/bid/101665 · Broken Link
securitytracker.com/id/1041610 · Broken Link
access.redhat.com/errata/RHSA-2018:2692 · Third Party Advisory
access.redhat.com/errata/RHSA-2018:2693 · Third Party Advisory
access.redhat.com/errata/RHSA-2018:3403 · Third Party Advisory
access.redhat.com/errata/RHSA-2018:3458 · Third Party Advisory
blog.torproject.org/tor-browser-709-released · Issue Tracking
bugzilla.mozilla.org/show_bug.cgi · Exploit
lists.debian.org/debian-lts-announce/2018/11/msg00011.html · Mailing List
security.gentoo.org/glsa/201810-01 · Third Party Advisory
security.gentoo.org/glsa/201811-13 · Third Party Advisory
trac.torproject.org/projects/tor/ticket/24052 · Issue Tracking

More vulnerabilities in tor

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

tor

torproject

< 7.0.9

7.0.9

More vulnerabilities in tor

See all →