Tor Browser 4.0.8 is released

A new release for the stable Tor Browser is available from the Tor Browser Project page and also from our distribution directory.

This release contains a fix for the update loop issue present in 4.0.7. It is otherwise identical to that release.

Both 4.0.7 and 4.0.8 contain an update to the included Tor software, to fix two crash bugs in the version of the Tor software included prior to 4.0.7. One crash bug affects only people using the bundled tor binary to run hidden services, and the other crash bug allows a malicious website or Tor exit node to crash the underlying tor client by inducing it to load a resource from a hidden service with a malformed descriptor. These bugs do not allow remote code execution, but because they can be used by arbitrary actors to perform a denial of service, we are issuing a security update to address them.

There will be no corresponding 4.5-alpha release for this fix, to allow us to focus on stabilizing that series for release in ~2 weeks.

Note to MacOS users: This is the last planned release that will run on 32 bit MacOS versions. Users of Mac OS 10.8 (Mountain Lion) and newer versions will be automatically updated to the 64 bit Tor Browser 4.5 when it is stabilized in April, and we expect this transition to be smooth for those users. However, the update process for 10.6 and 10.7 users will unfortunately not be automatic. For more details, see the original end-of-life blog post.

Here is the complete changelog since 4.0.6 (covering 4.0.7 and 4.0.8):

  • All Platforms
    • Bug 15637: Fix update loop due to improper versioning
    • Update Tor to 0.2.5.12
    • Update NoScript to 2.6.9.21
Tags
tor browser bundle
tor browser
tbb
tbb-4.0

I have experienced that on occasion for as far as back as I can recall.

The following usually works (but will close any and all instances of regular Firefox that may be running). Open a terminal and execute the following command:

killall firefox

Then restart Tor Browser.

Sorry, it just hit me that my previous response assumed you were also a (GNU+)Linux user, when from your post it was clear that you are a Windows user.

Anonymous

Anonymous (not verified) said:

April 24, 2015

Permalink

Please allow "One Click" access in place of "Long Press" option in Orbot. I have faced this incident where accidentally my phone dropped out of the bag and when I tried again to use Orbot, I was no longer able to as I was told that my phone suffered some display issue and so I lost "Touch and Hold" functionality. I was trapped and had no option left to communicate with privacy

Please allow a simple one-tap access within the app.

Anonymous

Anonymous (not verified) said:

April 24, 2015

Permalink

I got a question. I recently attained bookmarks from my firefox browser by exporting to HTML. I imported them into the new tor browser (4.0.8). Now I have bookmarks from my firefox browser in my tor browser. Is this OKAY? Do they use different coding? Will my ISP be able to tell that it's not actually firefox I'm using but Tor browser? They figured it out once when I opened both at the same time and blocked it. Can they figure it out from the bookmarks? Does it compromise my anonymity in any way?

Anonymous

Anonymous (not verified) said:

May 01, 2015

Permalink

Tor warned me about someone trying to hack and get me to click something. Never seen that warning before. I closed tor immediately.

Anonymous

Anonymous (not verified) said:

May 31, 2015

Permalink

What domains do we need to authorize in order for the Google Capcha dialog to correctly display its images? This is the common capcha that Google is promoting now across the web for use by third party web sites.