CVE-2008-5397

Severity: high (CVSS 7.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-12-09 · updated 2026-06-16
Weakness: CWE-264

Description

Tor before 0.2.0.32 does not properly process the (1) User and (2) Group configuration options, which might allow local users to gain privileges by leveraging unintended supplementary group memberships of the Tor process.

Affected products

Tor: through 0.1.2.31; 0.0.2, 0.0.2_pre13, 0.0.2_pre14, 0.0.2_pre15, 0.0.2_pre16, 0.0.2_pre17 (+93)

References

http://blog.torproject.org/blog/tor-0.2.0.32-released
http://secunia.com/advisories/33025
http://secunia.com/advisories/34583
http://security.gentoo.org/glsa/glsa-200904-11.xml
http://www.securityfocus.com/bid/32648
http://www.vupen.com/english/advisories/2008/3366
https://exchange.xforce.ibmcloud.com/vulnerabilities/47101
http://blog.torproject.org/blog/tor-0.2.0.32-released
http://secunia.com/advisories/33025
http://secunia.com/advisories/34583
http://security.gentoo.org/glsa/glsa-200904-11.xml
http://www.securityfocus.com/bid/32648

Get alerted when CVE-2008-5397 or the next vulnerability affects your stack