From the webpage:
Tor Browser 6.0.7 is now available from the Tor Browser Project page and also from our distribution directory.
This release features an important security update to Firefox and contains, in addition to that, an update to NoScript (2.9.5.2).
The security flaw responsible for this urgent release is already actively exploited on Windows systems. Even though there is currently, to the best of our knowledge, no similar exploit for OS X or Linux users available the underlying bug affects those platforms as well. Thus we strongly recommend that all users apply the update to their Tor Browser immediately. A restart is required for it to take effect.
Tor Browser users who had set their security slider to “High” are believed to have been safe from this vulnerability.
We will have alpha and hardened Tor Browser updates out shortly. In the meantime, users of these series can mitigate the security flaw in at least two ways:
1) Set the security slider to “High” as this is preventing the exploit from working.
2) Switch to the stable series until updates for alpha and hardened are available, too.Here is the full changelog since 6.0.6:
- All Platforms
- Update Firefox to 45.5.1esr
- Update NoScript to 2.9.5.2
A reminder from the Tor project that:
many eyes make all bugs shallow
is marketing talk for open source, nothing more.
For more on that theme: Linus’s Law aka “Many Eyes Make All Bugs Shallow” by Jeff Jones.
A little over 10 years old now, predating HeartBleed for example, but still an interesting read.
I am and remain an open source advocate but not on the basis of false claims of bug finding. Open source improves your changes of finding spyware. No guarantees but open source improves your chances.
Why any government or enterprise would run closed source software is a mystery to me. Upload all your work to the NSA on a weekly basis. With uploads you create a reminder of your risk, which is missing with non-open source software.