Tor Browser CVE-2019-13075 Information Disclosure Vulnerability

Bugtraq ID:	108944
Class:	Input Validation Error
CVE:	CVE-2019-13075
Remote:	Yes
Local:	No
Published:	May 29 2019 12:00AM
Updated:	May 29 2019 12:00AM
Credit:	ryotak
Vulnerable:	Tor Project Tor 8.5.3 Tor Project Tor 8.0.1 Tor Project Tor 7.5.6 Tor Project Tor 7.5.3 Tor Project Tor 7.0.11 Tor Project Tor 7.0.10 Tor Project Tor 6.0.7 Tor Project Tor 3.5.7 Tor Project Tor 3.5.6 Tor Project Tor 0.4 Tor Project Tor 7.5 Tor Project Tor 6.0 Tor Project Tor 5.0 Tor Project Tor 4.0 Tor Project Tor 2.3.25-1 Tor Project Tor 2.2.35-6 Tor Project Tor 0.4.0.2 Tor Project Tor 0.3.5.8 Tor Project Tor 0.3.5.0 Tor Project Tor 0.3.5. Tor Project Tor 0.3.4.11 Tor Project Tor 0.3.4.10 Tor Project Tor 0.3.4.0 Tor Project Tor 0.3.3.12 Tor Project Tor 0.3.3.11 Tor Project Tor 0.3.2.9 Tor Project Tor 0.3.2.10 Tor Project Tor 0.3.2.0 Tor Project Tor 0.3.1.9 Tor Project Tor 0.3.1.7 Tor Project Tor 0.3.1.10 Tor Project Tor 0.3.1.0 Tor Project Tor 0.3.0.11 Tor Project Tor 0.3.0.10 Tor Project Tor 0.3.0.0 Tor Project Tor 0.2.9.15 Tor Project Tor 0.2.9.14 Tor Project Tor 0.2.9.12 Tor Project Tor 0.2.9.11 Tor Project Tor 0.2.9.0 Tor Project Tor 0.2.8.9 Tor Project Tor 0.2.8.8 Tor Project Tor 0.2.8.15 Tor Project Tor 0.2.8.14
Not Vulnerable:

Tor Browser CVE-2019-13075 Information Disclosure Vulnerability

Tor Browser is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks.

Tor Browser 8.5.3 and prior are vulnerable.

Tor Browser CVE-2019-13075 Information Disclosure Vulnerability

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

Tor Browser CVE-2019-13075 Information Disclosure Vulnerability

References:

• Detect Tor Browser's language (Hackerone)
  
• Tor Browser Bundle Homepage (Tor)
  
• Tor Browser locale is leaked via title of link tag on non-html page (torproject.org)