Tor Browser Launcher (aka torbrowser-launcher) before 0.2.4, during the initial run, allows man-in-the-middle attackers to bypass the PGP signature verification and execute arbitrary code via a Trojan horse tar file and a signature file with the valid tarball and signature.
References
Link | Resource |
---|---|
http://www.securityfocus.com/bid/96140 | Third Party Advisory VDB Entry |
https://github.com/micahflee/torbrowser-launcher/issues/229 | Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2017-02-07T17:00:00
Updated: 2017-02-09T10:57:02
Reserved: 2016-03-15T00:00:00
Link: CVE-2016-3180
JSON object: View
NVD Information
Status : Analyzed
Published: 2017-02-07T17:59:00.427
Modified: 2017-02-28T19:22:12.920
Link: CVE-2016-3180
JSON object: View
Redhat Information
No data.
CWE