Code injection

2017-02-0717:59:00

PRIOn knowledge base

www.prio-n.com

7.9 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

45.1%

JSON

Tor Browser Launcher (aka torbrowser-launcher) before 0.2.4, during the initial run, allows man-in-the-middle attackers to bypass the PGP signature verification and execute arbitrary code via a Trojan horse tar file and a signature file with the valid tarball and signature.

CPENameOperatorVersion
tor_browser_launchereq0.2.3

CPE	Name	Operator	Version
	tor_browser_launcher	eq	0.2.3

References

www.securityfocus.com/bid/96140

github.com/micahflee/torbrowser-launcher/issues/229