CVE-2019-12383
Tor Browser before 8.0.1 has an information exposure vulnerability. It allows remote attackers to...
Tor Browser before 8.0.1 has an information exposure vulnerability. It allows remote attackers to detect the browser's UI locale by measuring a button width, even if the user has a "Don't send my language" setting.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Tor Browser before 8.0.1 has an information exposure vulnerability. It allows remote attackers to detect the browser's UI locale by measuring a button width, even if the user has a "Don't send my language" setting.
- Record
CVE-2019-12383- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
CVE List No score
Tor Browser before 8.0.1 has an information exposure vulnerability. It allows remote attackers to detect the browser's UI locale by measuring a button width, even if the user has a "Don't send my language" setting.
- Record
CVE-2019-12383- Updated
- 2026-11-02
EUVDEUVD-2019-4018 No score
Tor Browser before 8.0.1 has an information exposure vulnerability. It allows remote attackers to detect the browser's UI locale by measuring a button width, even if the user has a "Don't send my language" setting.
- Record
EUVD-2019-4018- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9c7r-v445-c52r
Tor Browser before 8.0.1 has an information exposure vulnerability. It allows remote attackers to...
Tor Browser before 8.0.1 has an information exposure vulnerability. It allows remote attackers to detect the browser's UI locale by measuring a button width, even if the user has a "Don't send my language" setting.
- Record
GHSA-9c7r-v445-c52r- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
OSV
Tor Browser before 8.0.1 has an information exposure vulnerability. It allows remote attackers to detect the browser's UI locale by measuring a button width, even if the user has a "Don't send my language" setting.
- Record
CVE-2019-12383- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-12383
Tor Browser before 8.0.1 has an information exposure vulnerability. It allows remote attackers to detect the browser's UI locale by measuring a button width, even if the user has a "Don't send my language" setting.
- Record
DEBIAN-CVE-2019-12383- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
firefox-esrDebian:12 |
All versions, plus listed versions 102.11.0esr-1102.12.0esr-1102.12.0esr-1~deb10u1102.12.0esr-1~deb11u1102.12.0esr-1~deb12u1 Show 45 moreShow less102.13.0esr-1102.13.0esr-1~deb10u1102.13.0esr-1~deb11u1102.13.0esr-1~deb12u1102.14.0esr-1~deb10u1102.14.0esr-1~deb11u1102.14.0esr-1~deb12u1102.15.0esr-1~deb10u1102.15.0esr-1~deb11u1102.15.0esr-1~deb12u1102.15.1esr-1~deb10u1102.15.1esr-1~deb11u1102.15.1esr-1~deb12u1115.0.2esr-1115.1.0esr-1115.10.0esr-1115.10.0esr-1~deb10u1115.10.0esr-1~deb11u1115.10.0esr-1~deb12u1115.11.0esr-1115.11.0esr-1~deb10u1115.11.0esr-1~deb11u1115.11.0esr-1~deb12u1115.12.0esr-1115.12.0esr-1~deb10u1115.12.0esr-1~deb11u1115.12.0esr-1~deb12u1115.13.0esr-1115.13.0esr-1~deb11u1115.13.0esr-1~deb12u1115.13.0esr-2115.14.0esr-1115.14.0esr-1~deb11u1115.14.0esr-1~deb12u1115.15.0esr-1115.15.0esr-1~deb11u1115.15.0esr-1~deb12u1115.2.0esr-1115.2.1esr-1115.3.0esr-1115.3.0esr-1~deb10u1115.3.0esr-1~deb11u1115.3.0esr-1~deb12u1115.3.1esr-1~deb10u1115.3.1esr-1~deb11u1 |
None known |
firefox-esrDebian:13 |
All versions, plus listed versions 128.13.0esr-1128.14.0esr-1128.14.0esr-1~deb11u1128.14.0esr-1~deb12u1128.14.0esr-1~deb13u1 Show 45 moreShow less140.10.0esr-1140.10.0esr-1~deb11u1140.10.0esr-1~deb12u1140.10.0esr-1~deb13u1140.10.1esr-1140.10.1esr-1~deb11u1140.10.1esr-1~deb12u1140.10.1esr-1~deb13u1140.10.2esr-1140.10.2esr-1~deb11u1140.10.2esr-1~deb12u1140.10.2esr-1~deb13u1140.11.0esr-1140.11.0esr-1~deb11u1140.11.0esr-1~deb12u1140.11.0esr-1~deb13u1140.12.0esr-1140.12.0esr-1~deb11u1140.12.0esr-1~deb12u1140.12.0esr-1~deb13u1140.13.0esr-1140.13.0esr-1~deb11u1140.13.0esr-1~deb12u1140.13.0esr-1~deb13u1140.13.0esr-2140.14.0esr-1~deb11u1140.14.0esr-1~deb12u1140.14.0esr-1~deb13u1140.14.0esr-2140.15.0esr-1140.15.0esr-1~deb12u1140.15.0esr-1~deb13u1140.16.0esr-1140.16.0esr-1~deb12u1140.16.0esr-1~deb13u1140.3.0esr-1140.3.0esr-1~deb11u1140.3.0esr-1~deb11u2140.3.0esr-1~deb12u1140.3.0esr-1~deb13u1140.3.0esr-2140.3.1esr-1140.3.1esr-1~deb11u1140.3.1esr-1~deb12u1140.3.1esr-1~deb13u1 |
None known |
firefox-esrDebian:14 |
All versions, plus listed versions 128.13.0esr-1128.14.0esr-1128.14.0esr-1~deb11u1128.14.0esr-1~deb12u1128.14.0esr-1~deb13u1 Show 45 moreShow less140.10.0esr-1140.10.0esr-1~deb11u1140.10.0esr-1~deb12u1140.10.0esr-1~deb13u1140.10.1esr-1140.10.1esr-1~deb11u1140.10.1esr-1~deb12u1140.10.1esr-1~deb13u1140.10.2esr-1140.10.2esr-1~deb11u1140.10.2esr-1~deb12u1140.10.2esr-1~deb13u1140.11.0esr-1140.11.0esr-1~deb11u1140.11.0esr-1~deb12u1140.11.0esr-1~deb13u1140.12.0esr-1140.12.0esr-1~deb11u1140.12.0esr-1~deb12u1140.12.0esr-1~deb13u1140.13.0esr-1140.13.0esr-1~deb11u1140.13.0esr-1~deb12u1140.13.0esr-1~deb13u1140.13.0esr-2140.14.0esr-1~deb11u1140.14.0esr-1~deb12u1140.14.0esr-1~deb13u1140.14.0esr-2140.15.0esr-1140.15.0esr-1~deb12u1140.15.0esr-1~deb13u1140.16.0esr-1140.16.0esr-1~deb12u1140.16.0esr-1~deb13u1140.3.0esr-1140.3.0esr-1~deb11u1140.3.0esr-1~deb11u2140.3.0esr-1~deb12u1140.3.0esr-1~deb13u1140.3.0esr-2140.3.1esr-1140.3.1esr-1~deb11u1140.3.1esr-1~deb12u1140.3.1esr-1~deb13u1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-12383 is a medium vulnerability (CVSS 4.3) in Torproject Tor Browser, published May 28, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.16%, the 82nd percentile. No source names a fixed version.
References
trac.torproject.org/projects/tor/ticket/24056
hackerone.com/reports/282748
gitweb.torproject.org/tor-browser.git/commit?id=cbb04b72c68272c2de42f157d40cd7d29a6b7b55
securityfocus.com/bid/108484
nvd.nist.gov/vuln/detail/CVE-2019-12383
github.com/advisories/GHSA-9c7r-v445-c52r
security-tracker.debian.org/tracker/CVE-2019-12383
Left out here: 221 versions. The JSON record has them.