Most recent entries from all

ALSA-2023:3922 — Critical: go-toolset:rhel8 security update

Affected: AlmaLinux:8: delve, AlmaLinux:8: go-toolset, AlmaLinux:8: golang, AlmaLinux:8: golang-bin, AlmaLinux:8: golang-docs, AlmaLinux:8: golang-misc, AlmaLinux:8: golang-race, AlmaLinux:8: golang-src, AlmaLinux:8: golang-tests

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

* golang: cmd/go: go command may generate unexpected code at build time when using cgo (CVE-2023-29402) * golang: cmd/go: go command may execute arbitrary code at build time when using cgo (CVE-2023-29404) * golang: cmd/cgo: Arbitratry code execution triggered by linker flags (CVE-2023-29405) * golang: runtime: unexpected behavior of setuid/setgid binaries (CVE-2023-29403)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2023-03200

Withdrawn: BELL-CVE-2023-29403 — CVE-2023-29403 does not affect BellSoft software

Withdrawn by the publisher.

BIT-golang-2023-29403 — Unsafe behavior in setuid/setgid binaries in runtime

Affected: Bitnami: golang

On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.

certfr-2023-avi-0650 — De multiples vulnérabilités ont été découvertes dans IBM Spectrum Copy Data Management. Certaines d'entre elles permett…

certfr-2023-avi-0650

EUVD-2026-216415

fkie_cve-2023-29403

GHSA-rxx3-4978-3cc9

gsd-2023-29403

msrc_CVE-2023-29403 — Unsafe behavior in setuid/setgid binaries in runtime

msrc_CVE-2023-29403

OESA-2023-1404 — golang security update

Affected: openEuler:20.03-LTS-SP1: golang, openEuler:20.03-LTS-SP3: golang, openEuler:22.03-LTS: golang, openEuler:22.03-LTS-SP1: golang, openEuler:22.03-LTS-SP2: golang

The Go Programming Language

Security Fix(es):

openSUSE-SU-2024:12987-1 — go1.19-1.19.10-1.1 on GA media

go1.19-1.19.10-1.1 on GA media

RHSA-2023:3920 — Red Hat Security Advisory: go-toolset-1.19 and go-toolset-1.19-golang security update

golang: cmd/go: go command may generate unexpected code at build time when using cgo golang: runtime: unexpected behavior of setuid/setgid binaries golang: cmd/go: go command may execute arbitrary code at build time when using cgo golang: cmd/cgo: Arbitrary code execution triggered by linker flags

UBUNTU-CVE-2023-29403

Affected: Ubuntu:14.04:LTS: golang-1.10, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.8 and 10 more

WID-SEC-W-2023-1377 — Golang Go: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um Code auszuführen, Informationen offenzulegen oder nicht näher spezifizierte Auswirkungen zu erzielen.