CVE-2025-22867

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executablepath, @loaderpath, or @rpath special values in a "cgo LDFLAGS" directive. This issue only affected go1.24rc2...

CVE-2025-22867

Building a Go module containing CGO on Darwin can lead to arbitrary code execution when utilizing the Apple version of ld . This vulnerability is caused by the use of special values such as @executable_path, @loader_path, or @rpath within a "#cgo LDFLAGS" directive. The issue specifically affecte...

CVE-2025-22867

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executablepath, @loaderpath, or @rpath special values in a "cgo LDFLAGS" directive. This issue only affected go1.24rc2...

GO-2025-3428 Arbitrary code execution during build on darwin in cmd/go

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executablepath, @loaderpath, or @rpath special values in a "cgo LDFLAGS" directive. This issue only affected go1.24rc2...

PT-2025-5843

Name of the Vulnerable Software and Affected Versions: go versions 1.24rc2 Description: The issue is related to building a Go module that contains CGO on Darwin. It can trigger arbitrary code execution when using the Apple version of ld. This is due to the usage of special values @executable path...

Google Go security vulnerabilities

Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google USA. A security vulnerability exists in Google Go that stems from the use of Apple's ld with special values in the cgo LDFLAGS instruction on Darwin systems, which could trigger...

CVE-2025-22867: Undefined Security Weakness

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executablepath, @loaderpath, or @rpath special values in a "cgo LDFLAGS" directive. This issue only affected go1.24rc2...

etcd:fuzz_mvcc_storage: Crash in ___interceptor_pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5591102580654080 Project: etcd Fuzzing Engine: libFuzzer Fuzz Target: fuzzmvccstorage Job Type: libfuzzerasanetcd Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x78319046bbe1 Crash State: interceptorpthreadcreate cgotrypthreadcreate...

USN-7111-1 golang-1.17 vulnerabilities

Philippe Antoine discovered that Go incorrectly handled crafted HTTP/2 streams. An attacker could possibly use this issue to cause a denial of service. CVE-2022-41723 Marten Seemann discovered that Go did not properly manage memory under certain circumstances. An attacker could possibly use this...

openSUSE Security Advisory (SUSE-SU-2024:3773-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2024:3772-1 Security update for go1.22-openssl

This update for go1.22-openssl fixes the following issues: This update ships go1.22-openssl 1.22.7.1 jscSLE-18320 - Update to version 1.22.7.1 cut from the go1.22-fips-release branch at the revision tagged go1.22.7-1-openssl-fips. Update to Go 1.22.7 229 - go1.22.7 released 2024-09-05 includes...

protoreflect:fuzz_protoparse: Crash in ___interceptor_pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5051694380023808 Project: protoreflect Fuzzing Engine: libFuzzer Fuzz Target: fuzzprotoparse Job Type: libfuzzerasanprotoreflect Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7ec2ad30e780 Crash State: interceptorpthreadcreate...

Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example cgo can execute a gcc program from an untrusted download).

...

golang bug fix update

An update is available for golang. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The golang packages provide the Go programming language compiler. Bug Fixes:...

BIT-GOLANG-2024-24787 Arbitrary code execution during build on Darwin in cmd/go

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -ltolibrary flag in a "cgo LDFLAGS" directive...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.22 (SUSE-SU-2024:1587-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1587-1 advisory. Update to go1.22.3: - CVE-2024-24787: cmd/go: arbitrary code execution during build on darwin...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.21 (SUSE-SU-2024:1588-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1588-1 advisory. Update to go1.21.10: - CVE-2024-24787: cmd/go: arbitrary code execution during build on darwin bsc1224017...

Exploit for CVE-2024-24787

CVE-2024-24787-PoC On Darwin, building a Go module which cont...

SUSE SLES12 Security Update : go1.22 (SUSE-SU-2024:1573-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1573-1 advisory. Update to go1.22.3: - CVE-2024-24787: cmd/go: arbitrary code execution during build on darwin bsc1224017 - CVE-2024-24788: net: hig...

SUSE SLES12 Security Update : go1.21 (SUSE-SU-2024:1574-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1574-1 advisory. Update to go1.21.10: - CVE-2024-24787: cmd/go: arbitrary code execution during build on darwin bsc1224017 - net/http: TestRequestLimit/h2...