On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a “#cgo LDFLAGS” directive.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 10 | all | golang-1.11 | < 1.11.6-1+deb10u4 | golang-1.11_1.11.6-1+deb10u4_all.deb |
Debian | 11 | all | golang-1.15 | < 1.15.15-1~deb11u4 | golang-1.15_1.15.15-1~deb11u4_all.deb |
Debian | 12 | all | golang-1.19 | < 1.19.8-2 | golang-1.19_1.19.8-2_all.deb |
Debian | 999 | all | golang-1.21 | < 1.21.11-1 | golang-1.21_1.21.11-1_all.deb |
Debian | 13 | all | golang-1.21 | < 1.21.11-1 | golang-1.21_1.21.11-1_all.deb |
Debian | 999 | all | golang-1.22 | < 1.22.4-1 | golang-1.22_1.22.4-1_all.deb |
Debian | 13 | all | golang-1.22 | < 1.22.4-1 | golang-1.22_1.22.4-1_all.deb |