Updated golang packages fix security vulnerability

A flaw was found in Go Lang. The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path get/vcs.go only checks for "://" anywhere in the string, which allows remote attackers to execute arbitrary OS commands via a crafted web site...

Google Golang Get Command Injection (CVE-2018-7187)

A command injection vulnerability exists in the golang client. This vulnerability is due to insufficient sanitization of user input by the go get command...

GLSA-201804-12 : Go: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-201804-12 Go: Arbitrary code execution A vulnerability in Go was discovered which does not validate the import path of remote repositories. Impact : Remote attackers, by enticing a user to import from a crafted website, could...

Amazon Linux AMI : golang (ALAS-2018-975)

Arbitrary code execution during 'go get' via C compiler options : An arbitrary command execution flaw was found in the way Go's 'go get' command handled gcc and clang sensitive options during the build. A remote attacker capable of hosting malicious repositories could potentially use this flaw to...

Medium: golang

Issue Overview: Arbitrary code execution during "go get" via C compiler options: An arbitrary command execution flaw was found in the way Go's "go get" command handled gcc and clang sensitive options during the build. A remote attacker capable of hosting malicious repositories could potentially u...

[SECURITY] [DLA 1294-1] golang security update

Package : golang Version : 2:1.0.2-1.1+deb7u3 CVE ID : CVE-2018-7187 It was discovered that there was an arbitrary command execution vulnerability in the Go programming language. The "go get" implementation did not correctly validate "import path" statements for "://" which allowed remote attacke...

CVE-2018-7187

The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path get/vcs.go only checks for "://" anywhere in the string, which allows remote attackers to execute arbitrary OS commands via a crafted web site...

CVE-2018-7187

The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path get/vcs.go only checks for "://" anywhere in the string, which allows remote attackers to execute arbitrary OS commands via a crafted web site...

CVE-2018-7187

Removed by vendor...

CVE-2018-7187

The CVE-2018-7187 issue affects the Go go get implementation. In Go 1.9.4, when the -insecure option is used, the code path that validates import URLs does not properly restrict the import path (get/vcs.go checks for "://" anywhere in the string). This allows a crafted website to trigger remote c...

kernel, perf, python security update

CentOS Errata and Security Advisory CESA-2017:1842 An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Oracle Linux 7 : kernel (ELSA-2017-1842-1) (Stack Clash)

The remote Oracle Linux host is missing a security update for the kernel packages. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from Oracle Linux Security Advisory ELSA-2017-1842-1. if NASLLEVEL 3000 exit0; include'deprecatednasllevel.inc';...

RedHat Update for kernel RHSA-2017:1842-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 7 : kernel (RHSA-2017:1842)

"The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:1842 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: An use-after-free flaw was found in t...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:1360-1)

The SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.74 to receive various security and bugfixes. Notable new/improved features : - Improved support for Hyper-V - Support for the tcpwestwood TCP scheduling algorithm The following security bugs were fixed : - CVE-2017-8106: The handleinvept...

Ubuntu: Security Advisory (USN-3291-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-3291-3: Linux kernel (Xenial HWE) vulnerabilities

USN-3291-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Dmitry Vyukov discovered that the generic SCSI sg subsystem in the Linux kernel...

USN-3291-2: Linux kernel vulnerabilities

USN-3291-1 fixed vulnerabilities in the generic Linux kernel. This update provides the corresponding updates for the Linux kernel built for specific processors and cloud environments. Dmitry Vyukov discovered that the generic SCSI sg subsystem in the Linux kernel contained a stack-based buffer...

Ubuntu: Security Advisory (USN-3291-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 17.04 : linux, linux-raspi2 vulnerabilities (USN-3293-1)

Dmitry Vyukov discovered that KVM implementation in the Linux kernel improperly emulated the VMXON instruction. A local attacker in a guest OS could use this to cause a denial of service memory consumption in the host OS. CVE-2017-2596 Dmitry Vyukov discovered that the generic SCSI sg subsystem i...