Date: Tue, 9 Apr 2019 02:26:07 +0200 From: "Jason A. Donenfeld" <Jason@...c4.com> To: oss-security <oss-security@...ts.openwall.com> Subject: DLL injection in Go < 1.12.2 [CVE-2019-9634] Hey folks, Golang before 1.12.2 linked against various DLLs that were same-directory injectable and generally its library loading mechanism did not use LoadLibraryEx, allowing the classic DLL injection attacks, especially with regards to executables saved to the Downloads/ folder [1]. It was assigned CVE-2019-9634 and fixed in [2] and [3]. It wasn't mentioned in the 1.12.2 release notes, so I'm mentioning it here instead. Jason [1] https://user-images.githubusercontent.com/10643/53921755-eb9e1a00-4071-11e9-83a7-058ceb008e55.gif [2] https://github.com/golang/go/commit/9b6e9f0c8c66355c0f0575d808b32f52c8c6d21c [3] https://github.com/golang/sys/commit/10058d7d4faa7dd5ef860cbd31af00903076e7b8

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.