80 matches found
IOBitUnlockerUnlocker
Intro 0 day Moves or Copies any file. Bypasses previous patch with a checksum trick. Writup: https://nathan2.com/files/iobit.pdf Overall info: https://nathan2.com/posts/iobit/ I discovered this without knowing that this there was another previous exploit that discovered this first. However, this...
Linux Distros Unpatched Vulnerability : CVE-2026-94447
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the use...
SUSE SLED15 / SLES15 Security Update : go1.26 (SUSE-SU-2026:4629-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4629-1 advisory. Update to go 1.26.9 bsc1255111: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on...
Security update for go1.26
This update for go1.26 fixes the following issues: Update to go 1.26.9 bsc1255111: CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on Windows bsc1284766. CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection bsc1284767. CVE-2026-78659:...
Security update for go1.27
This update for go1.27 fixes the following issues: Update to go1.27.2 bsc1272545: CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on Windows bsc1284766. CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection bsc1284767. CVE-2026-78659:...
SUSE-SU-2026:4625-1 Security update for go1.27
This update for go1.27 fixes the following issues: Update to go1.27.2 bsc1272545: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on Windows bsc1284766. - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection bsc1284767. -...
CVE-2025-66676
CVE-2025-66676 In IOBit Unlocker 1.3.0.11 and earlier, the application allows arbitrary process termination by trying to unlock a file. Background The application is used to unlock a unlocked file. By specifying the process image file of a running process as the locked file, IOBit unlocker will t...
EUVD-2026-95418
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical...
AZL-107454 CVE-2026-94447 affecting package golang 1.26.7-1
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical...
AZL-107483 CVE-2026-94447 affecting package golang 1.27.1-1
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical...
DEBIAN-CVE-2026-94447
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical...
CVE-2026-94447
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical...
CVE-2026-94447
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical...
CVE-2026-94444 Checksum bypass for golang.org/fips140 in cmd/go
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and...
CVE-2026-94447
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical...
CVE-2026-94447
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical...
CVE-2026-94444
A vulnerability in the Go toolchain allows a user operating inside a malicious Go project to serve an arbitrary module in place of the golang.org/fips140 module when connecting to a malicious GOMODPROXY . The fix involves unpacking the trusted ziphash for the bundled golang.org/fips140 module and...
CVE-2026-94447
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical...
GO-2026-6601 Checksum bypass for golang.org/fips140 in cmd/go
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and...
CVE-2026-94447: Undefined Security Weakness
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical...