CVE-2020-28366

Removed by vendor...

CVE-2020-28367

Removed by vendor...

CVE-2020-28367

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a cgo directive...

CVE-2020-28367 Arbitrary code execution via the go command with cgo in cmd/go

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a cgo directive...

CVE-2020-28367

CVE-2020-28367 : Code injection in the go command with cgo allows arbitrary code execution at build time via malicious gcc flags in a #cgo directive. Affected: Go before 1.14.12 and before 1.15.5. Mitigation: upgrade to Go 1.14.12+ and 1.15.5+ (patches available per advisories).

CVE-2020-28366

CVE-2020-28366 affects the Go toolchain: code injection/arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file, impacting go commands using cgo before Go 1.14.12 and Go 1.15.5. The described impact is at build time, not runtime, with a high-severity pr...

CVE-2020-28367: Improper Control of Generation of Code

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a cgo directive...

CVE-2020-28366: Improper Control of Generation of Code

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file...

Google Go Cmd/go Code Execution Vulnerability

Google Go Cmd/go is a codebase that provides command support for the Go language from the U.S. company Google Google. A code execution vulnerability exists in versions prior to go 1.15.5,1 that stems from the fact that when using cgo, the go command may execute arbitrary code at build time. This...

FreeBSD : go -- math/big: panic during recursive division of very large numbers; cmd/go: arbitrary code execution at build time through cgo (db4b2f27-252a-11eb-865c-00155d646400)

The Go project reports : A number of math/big.Int methods Div, Exp, DivMod, Quo, Rem, QuoRem, Mod, ModInverse, ModSqrt, Jacobi, and GCD can panic when provided crafted large inputs. For the panic to happen, the divisor or modulo argument must be larger than 3168 bits on 32-bit architectures or 63...

go -- math/big: panic during recursive division of very large numbers; cmd/go: arbitrary code execution at build time through cgo

The Go project reports: A number of math/big.Int methods Div, Exp, DivMod, Quo, Rem, QuoRem, Mod, ModInverse, ModSqrt, Jacobi, and GCD can panic when provided crafted large inputs. For the panic to happen, the divisor or modulo argument must be larger than 3168 bits on 32-bit architectures or 633...

PT-2018-2521

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.8.7 Go 1.9.x versions prior to 1.9.4 Go 1.10 pre-releases prior to Go 1.10rc2 Description The issue is related to the "go get" command in the Go programming language, which allows remote command execution during source...

Reproducing Go binaries byte-by-byte

Fully reproducible builds are important because they bridge the gap between auditable open source and convenient binary artifacts. Technologies like TUF and Binary Transparency provide accountability for what binaries are shipped to users, but that's of limited utility if there is no way short of...

openSUSE Security Update : docker / go (openSUSE-SU-2014:1411-1)

Docker was updated to version 1.3.1 to fix two security issues and several other bugs. These security issues were fixed : - Prevent fallback to SSL protocols lower than TLS 1.0 for client, daemon and registry CVE-2014-5277. - Secure HTTPS connection to registries with certificate verification and...