CVE-2017-0377

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jul 2, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-03786.1XSS exists in the login_form function in views/helpers.php in Phamm before 0.6.7, exploitable via the PATH_INFO to main.php.CVE-2017-03797.5Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret CVE-2017-03805.9The rend_service_intro_established function in or/rendservice.c in Tor before 0.2.8.15, 0.2.9.x before 0.2.9.12, 0.3.0.x before 0.3.0.11, 0.CVE-2017-03817.8An information disclosure vulnerability in silk/NLSF_stabilize.c in libopus in Mediaserver could enable a local malicious application to acc CVE-2017-03827.8A remote code execution vulnerability in the Framesequence library could enable an attacker using a specially crafted file to execute arbitr CVE-2017-03837.8An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within th CVE-2017-03847.8An elevation of privilege vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in Audioserver could enable a local malicious a CVE-2017-03857.8An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the conte CVE-2017-03867.8An elevation of privilege vulnerability in the libnl library could enable a local malicious application to execute arbitrary code within the CVE-2017-03877.8An elevation of privilege vulnerability in Mediaserver could enable a local malicious application to execute arbitrary code within the conte CVE-2017-03885.5An elevation of privilege vulnerability in the External Storage Provider could enable a local secondary user to read data from an external s CVE-2017-03897.5A denial of service vulnerability in core networking could enable a remote attacker to use specially crafted network packet to cause a devic