The Tor Project is working on a fix for this, and this attack highlights the importance of allowing users to auto-update. Instead, the Tor Browser currently requires users to manually download and install the update of the Tor Browser Bundle. Tor does not provide automatic security updates. In this case, all users of older versions of the Tor Browser Bundle are potentially vulnerable and the issue requires immediate attention. This type of attack cannot be narrowly focused on particular Tor or Tor Browser users suspected of breaking the law, and leaves vulnerable the multitude of other users worldwide who depend on these tools for anonymity.

Given the importance of Tor to users around the world, the security of both Tor and the Tor Browser are absolutely critical. The Tor Browser is a modified version of Firefox that ships with the Tor Browser Bundle to provide users with an easy way to browse with Tor without any configuration required. Tor also allows users to circumvent several forms of surveillance and censorship. Tor is a powerful anonymity tool that allows human rights activists, dissidents and whistleblowers to use web services anonymously to avoid harassment, imprisonment and in some cases death. Tor and the Tor Browser: Security and the Importance of Updating Tor Browser Bundle users who have not updated to the most recent version are also at risk, and so we've provided a screenshot tutorial for how to update the Tor Browser Bundle below. If you are using software based on Firefox major version 21 or earlier, Thunderbird 17.06 or earlier, or SeaMonkey 2.18 or earlier, please update your software immediately. The malware exploits a serious JavaScript security vulnerability affecting Firefox and other products that share the same code base, including the Tor Browser. An attack against Tor Browser users on Windows machines was discovered this Sunday, and there is speculation that the uncovered malware was used by a law enforcement agency to harvest the IP addresses of users of several hidden services hosted by Freedom Hosting.

How to disable javascript in tor