Home  >  CVE-2016-3180
CVE Details for CVE: CVE-2016-3180
Summary
Tor Browser Launcher (aka torbrowser-launcher) before 0.2.4, during the initial run, allows man-in-the-middle attackers to bypass the PGP signature verification and execute arbitrary code via a Trojan horse tar file and a signature file with the valid tarball and signature.
Timestamps
Last major update 28-02-2017 - 19:22
Published 07-02-2017 - 17:59
Last modified 28-02-2017 - 19:22
References
Vulnerable Configurations
  • cpe:2.3:a:tor_browser_launcher_project:tor_browser_launcher:0.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:tor_browser_launcher_project:tor_browser_launcher:0.2.3:*:*:*:*:*:*:*
CAPEC
Click the CAPEC title to display a description
CWE
CWE-254
CVSS
Base
6.8
Impact
6.4
Exploitability
8.6
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
CVSS3
Base
8.1
Impact
5.9
Exploitability
2.2
Access
Attack ComplexityAttack vectorPrivileges RequiredScopeUser Interaction
HIGH NETWORK NONE UNCHANGED NONE
Impact
ConfidentialityIntegrityAvailability
HIGH HIGH HIGH
VIA4 references
cvss-vector via4
AV:N/AC:M/Au:N/C:P/I:P/A:P
cvss3-vector via4
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
refmap via4
bid 96140
confirm https://github.com/micahflee/torbrowser-launcher/issues/229