CVE-2007-4098
Tor before 0.1.2.15 does not properly distinguish "streamids from different exits," which might...
CVE-2007-4098 is a medium vulnerability (CVSS 5.8) in Tor, published July 30, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.90%, the 79th percentile. Fixed in tor 0.1.2.15-1.
Tor before 0.1.2.15 does not properly distinguish "streamids from different exits," which might allow remote attackers with control over Tor routers to inject cells into arbitrary streams.
Exploit likelihood
What each source reports
NVD Score used
Tor before 0.1.2.15 does not properly distinguish "streamids from different exits," which might allow remote attackers with control over Tor routers to inject cells into arbitrary streams.
- Record
CVE-2007-4098- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Tor before 0.1.2.15 does not properly distinguish "streamids from different exits," which might allow remote attackers with control over Tor routers to inject cells into arbitrary streams.
- Record
CVE-2007-4098- Updated
- 2026-11-02
EUVDEUVD-2007-4082 No score
Tor before 0.1.2.15 does not properly distinguish "streamids from different exits," which might allow remote attackers with control over Tor routers to inject cells into arbitrary streams.
- Record
EUVD-2007-4082- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7rwq-85qc-qq76 No score
Tor before 0.1.2.15 does not properly distinguish "streamids from different exits," which might...
Tor before 0.1.2.15 does not properly distinguish "streamids from different exits," which might allow remote attackers with control over Tor routers to inject cells into arbitrary streams.
- Record
GHSA-7rwq-85qc-qq76- Updated
- 2026-11-02
OSV No score
Tor before 0.1.2.15 does not properly distinguish "streamids from different exits," which might allow remote attackers with control over Tor routers to inject cells into arbitrary streams.
- Record
CVE-2007-4098- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-4098 No score
Tor before 0.1.2.15 does not properly distinguish "streamids from different exits," which might allow remote attackers with control over Tor routers to inject cells into arbitrary streams.
- Record
DEBIAN-CVE-2007-4098- Updated
- 2026-11-02
Affected products
Affected packages
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | affected, aliases, facts, references, title | GitHub Advisories, OSV |
| 2026-11-02 | created | CVE List, NVD |