Tor Browser 5.0.7 is released

Update: Clarify that the crash bug requires Javascript to be exercised.

A new stable release for Tor Browser is available from the Tor Browser Project page and also from our distribution directory.

This release features an important fix for a crash bug in one of our patches. All users are encouraged to update immediately as this bug is probably exploitable if Javascript is enabled. The bug was not exploitable at High security level, or on non-HTTPS websites at Medium-High security level.

Here is the complete changelog since 5.0.6:

  • All Platforms
    • Update NoScript to 2.9
    • Update HTTPS Everywhere to 5.1.2
    • Bug 17931: Tor Browser crashes in LogMessageToConsole()
    • Bug 17875: Discourage editing of torrc-defaults
Anonymous

January 11, 2016

Permalink

@DEV 5.07 / TEAM

Tor browser & virtual cpu function e.g intel 3337U, etc.

My chipset is able to manage virtual space ; should it be possible to run tor on this "unused area" ?

i use rarely VM or similar environement so this space is still free as a function 'opened', disposable.

if you know a trick/tip for activate or include tor by the cpu and not by the operating system , i could run it long hours per days and that every day.

i read that running a relay is important and running tor too.

Anonymous

January 12, 2016

Permalink

Again, no chance with adobe flash for me on this update. I use Tor solely to listen to the BBC, which is blocked here in Vietnam, and yet I cannot play any podcast because Tor cannot configure Adobe Flash or something. No, not afraid of being tracked down and incarcerated, I've heard the "Privacy is Important" drill enough, Vietnam's online surveillance and censorship is half-arsed, at most, and VPN doesn't work because God knows why my government hates The Archers so much as to block it to this extent. I understand what you're doing here and I commemorate it wholeheartedly, but I just want to be given the option whether or not to use Adobe Flash. Still am waiting for the day when I get to listen to good ole' BBC

What you should try is:

youtube-dl

http://rg3.github.com/youtube-dl

A lot of people post here saying with each new TBB release, "Flash still doesn't work!" No kidding? We don't know that already?

Check youtube-dl's list of supported sites at their website. You don't need a browser plugin/addon/extension for this.

I don't know if torify/torsocks is included in the TBB*, but in TAILS I run
at the command line (after downloading youtube-dl and a quick verify of the md5/sha1 or sha256 checksusms):

chmod a+rx youtube-dl

^ the chmod command only once, then:

  1. torsocks ./youtube-dl URLtovideoorpagewithvideo<br />

Easy.

Again, if you use TBB instead of TAILS, programs like youtube-dl may need an additional option. The website for youtube-dl explains it very well.

A lot of people post here saying with each new TBB release, "Flash still doesn't work!" No kidding? We don't know that already?

It's not "a lot of people"......

It's actually one troll working for the NSA that has been posting nearly similar complaints about Adobe Flash not working in TBB.

His ulterior motive is to ensnare unsuspecting TBB users to use Adobe Flash which is notorious for unmasking actual geolocations.

Again, no chance with adobe flash for me on this update. I use Tor solely to listen to the BBC, which is blocked here in Vietnam,

You don't need Adobe Flash to listen to BBC....

And we know who you're: whenever there's an announcement on the release of a new version of Tor, you'd never fail to post anonymously lamenting that you're unable to watch Youtube videos because Adobe Flash doesn't work on TBB.

and VPN doesn't work because God knows why my government hates The Archers so much as to block it to this extent.

Haha...we caught you there, you NSA troll.

It's obvious you don't live in Vietnam because if you did you'd discover that businesses and individuals in Vietnam do use VPNs daily. (I should know as I just left Vietnam after meeting my business partners)

Anonymous

January 21, 2016

Permalink

Hello, downloaded torbrowser-install-5.0.7_en-US.exe today from this site and pgp says that the signature is invalid, signed with unknown certificate 0x2E1AC68ED40814E0

That is different from the one in the tutorial which is 0x4E2C6E8793298290

Explain this?

They're the same key.

Specifically:

$ gpg --list-key 93298290
pub 4096R/93298290 2014-12-15 [expires: 2020-08-24]
uid Tor Browser Developers (signing key)
sub 4096R/F65C2036 2014-12-15 [expires: 2017-08-25]
sub 4096R/D40814E0 2014-12-15 [expires: 2017-08-25]

So 93298290 is the long-term key, and D40814E0 is one of its subkeys.

Make sure you have the subkey, and have verified the fingerprints of both long-term and subkey. gpg allows you to follow the chain-of-trust. This should fix the signature problem you describe. Always ensure the subkey has been signed by the long-term key and likewise for the subkey.