Aller au contenu
Se connecter
6.4 Moyenne

CVE-2024-24787 On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version…

Description

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

Produits et versions touchés

Produit Versions touchées Corrigé en
cmd/go 1.22 1.22.0-0 → < 1.22.3 1.22.3
cmd/go 1.21 premières → < 1.21.10 1.21.10
Go 1.22 Pas de correctif indiqué
Go 1.21.0 Pas de correctif indiqué

Autres CVE de cmd/go

Les 23 CVE de cmd/go →
CVE-2026-94444 Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a… 7.8 Élevée CVE-2026-94447 Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and… 7.8 Élevée CVE-2026-56865 A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to… 8.4 Élevée CVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log 7.5 Élevée
Suivre cette CVE