Date: Tue, 9 Apr 2019 02:26:07 +0200 From: "Jason A. Donenfeld" <Jason@...c4.com> To: oss-security <oss-security@...ts.openwall.com> Subject: DLL injection in Go < 1.12.2 [CVE-2019-9634] Hey folks, Golang before 1.12.2 linked against various DLLs that were same-directory injectable and generally its library loading mechanism did not use LoadLibraryEx, allowing the classic DLL injection attacks, especially with regards to executables saved to the Downloads/ folder . It was assigned CVE-2019-9634 and fixed in  and . It wasn't mentioned in the 1.12.2 release notes, so I'm mentioning it here instead. Jason  https://user-images.githubusercontent.com/10643/53921755-eb9e1a00-4071-11e9-83a7-058ceb008e55.gif  https://github.com/golang/go/commit/9b6e9f0c8c66355c0f0575d808b32f52c8c6d21c  https://github.com/golang/sys/commit/10058d7d4faa7dd5ef860cbd31af00903076e7b8
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.