UnratedFix available
tor — security advisory
Tor before 0.2.0.32 does not properly process the (1) User and (2) Group configuration options, which might allow local users to gain privileges by leveraging unintended supplementary group memberships of the Tor process.
- Products
- tor
- Affected versions
- Not specified
- Fixed versions
- 0.2.0.32-1
- CVEs
- CVE-2008-5397
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 22:29 UTC · Revision 1
Source evidence
Tor before 0.2.0.32 does not properly process the (1) User and (2) Group configuration options, which might allow local users to gain privileges by leveraging unintended supplementary group memberships of the Tor process.
osv:DEBIAN-CVE-2008-5397
tor
Fixed versions: 0.2.0.32-1
tor
Fixed versions: 0.2.0.32-1
tor
Fixed versions: 0.2.0.32-1
Complete source record
{
"id": "6a8414487d39ed808573f936563386943d7d711e49c9c15c2bb051a2c39244f5",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2008-5397",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2008-5397",
"summary": "Tor before 0.2.0.32 does not properly process the (1) User and (2) Group configuration options, which might allow local users to gain privileges by leveraging unintended supplementary group memberships of the Tor process.",
"evidence": "osv:DEBIAN-CVE-2008-5397",
"products": [
{
"name": {
"value": "tor",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.2.0.32-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tor",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.2.0.32-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tor",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.2.0.32-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2008-5397",
"aliases": [
"DEBIAN-CVE-2008-5397"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.0.32-1"
}
]
}
],
"package": {
"name": "tor",
"purl": "pkg:deb/debian/tor?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2008-5397.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.0.32-1"
}
]
}
],
"package": {
"name": "tor",
"purl": "pkg:deb/debian/tor?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2008-5397.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.0.32-1"
}
]
}
],
"package": {
"name": "tor",
"purl": "pkg:deb/debian/tor?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2008-5397.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T17:47:22.057330457Z",
"provider": "osv",
"upstream": [
"CVE-2008-5397"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2008-5397"
]
},
"related_cves": [
{
"value": "CVE-2008-5397",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 416550,
"published_at": "2008-12-09T00:30:00.567+00:00"
}