CVE-2008-5397: Tor

High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days.

Tor before 0.2.0.32 does not properly process the (1) User and (2) Group configuration options, which might allow local users to gain privileges by leveraging unintended supplementary group memberships of the Tor process.

Affected products

• Tor Tor: up to and including 0.1.2.31; version 0.0.2 only; version 0.0.2_pre13 only; version 0.0.2_pre14 only; version 0.0.2_pre15 only; version 0.0.2_pre16 only; …

Published 2008-12-09. Last modified 2026-06-16.