PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-3180 Tor Browser Launcher Project CVE debrief

CVE-2016-3180 affects Tor Browser Launcher (torbrowser-launcher) before 0.2.4. During the initial run, a man-in-the-middle attacker could bypass PGP signature verification and cause arbitrary code execution by supplying a trojan horse tar file together with a valid signature file. NVD classifies the issue as high severity and lists version 0.2.3 as vulnerable.

Vendor
Tor Browser Launcher Project
Product
CVE-2016-3180
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-07
Original CVE updated
2026-05-13
Advisory published
2017-02-07
Advisory updated
2026-05-13

Who should care

People using or packaging torbrowser-launcher before 0.2.4, especially anyone who installs or launches it for the first time over an untrusted network path or from a compromised mirror.

Technical summary

The issue is an initial-run trust failure in torbrowser-launcher. According to the CVE description, a MITM attacker can substitute a malicious tarball while still presenting a signature file that passes the launcher’s verification flow, allowing arbitrary code execution. NVD maps the affected product as tor_browser_launcher_project:tor_browser_launcher 0.2.3 and rates the CVSS vector as AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Defensive priority

High. The attack can lead to full compromise of the launcher’s execution context, but it depends on an initial-run network interception scenario rather than a simple unauthenticated remote trigger.

Recommended defensive actions

  • Upgrade torbrowser-launcher to 0.2.4 or later.
  • If you cannot upgrade immediately, avoid first-run installs or updates over networks you do not fully trust.
  • Validate the launcher package provenance through trusted distribution channels and checksums where available.
  • Review first-run automation and deployment workflows to ensure they do not rely on unauthenticated downloads.
  • Monitor systems that installed torbrowser-launcher before remediation for unexpected follow-on activity.

Evidence notes

This debrief is based on the supplied CVE description and the NVD record referenced in the corpus. The CVE was published on 2017-02-07T17:59:00.427Z and modified on 2026-05-13T00:24:29.033Z; those dates are used only as CVE timeline context, not as issue creation dates. NVD lists the vulnerable CPE for tor_browser_launcher_project:tor_browser_launcher:0.2.3 and references the vendor advisory issue tracker entry plus a third-party advisory. No KEV data was supplied for this CVE.

Official resources

Publicly disclosed in the CVE record on 2017-02-07. No KEV entry was supplied in the source corpus.