CVE-2017-16639

Severity: medium (CVSS 4.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-09-14 · updated 2026-06-17
Weakness: CWE-200

Description

Tor Browser on Windows before 8.0 allows remote attackers to bypass the intended anonymity feature and discover a client IP address, a different vulnerability than CVE-2017-16541. User interaction is required to trigger this vulnerability.

Affected products

torproject Tor Browser: before 8.0 — fixed in 8.0

How to fix

Upgrade to a fixed version: torproject Tor Browser 8.0. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/149351/Tor-Browser-SMB-Deanonymization-Information-Disclosure.html
http://www.securityfocus.com/bid/105346
https://seclists.org/bugtraq/2018/Sep/29
https://www.wearesegment.com/research/tor-browser-deanonymization-with-smb/
http://packetstormsecurity.com/files/149351/Tor-Browser-SMB-Deanonymization-Information-Disclosure.html
http://www.securityfocus.com/bid/105346
https://seclists.org/bugtraq/2018/Sep/29
https://www.wearesegment.com/research/tor-browser-deanonymization-with-smb/

Get alerted when CVE-2017-16639 or the next vulnerability affects your stack