CVE-2016-3180

2017-02-0717:59:00

Google

osv.dev

7.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.1%

JSON

Tor Browser Launcher (aka torbrowser-launcher) before 0.2.4, during the initial run, allows man-in-the-middle attackers to bypass the PGP signature verification and execute arbitrary code via a Trojan horse tar file and a signature file with the valid tarball and signature.

CPENameOperatorVersion
torbrowser-launchereq0.1.5
torbrowser-launchereq0.1.3
torbrowser-launchereq0.1.0
torbrowser-launchereq0.0.9
torbrowser-launchereq0.2.3
torbrowser-launchereq0.1.1
torbrowser-launchereq0.0.6
torbrowser-launchereq0.0.2
torbrowser-launchereq0.1.4
torbrowser-launchereq0.1.8

Name	Operator	Version
torbrowser-launcher	eq	0.1.5
torbrowser-launcher	eq	0.1.3
torbrowser-launcher	eq	0.1.0
torbrowser-launcher	eq	0.0.9
torbrowser-launcher	eq	0.2.3
torbrowser-launcher	eq	0.1.1
torbrowser-launcher	eq	0.0.6
torbrowser-launcher	eq	0.0.2
torbrowser-launcher	eq	0.1.4
torbrowser-launcher	eq	0.1.8