Description
Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the current working directory, related to use of the LoadLibrary function.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | stdlib | < 1.5.4 · >= 1.6.0-0, < 1.6.1 | 1.5.4, 1.6.1 | GO-2021-0163 |
References
- [oss-security] 20160405 Re: CVE request - Go - DLL loading, Big int mailing-list
- [golang-announce] 20160412 [security] Go 1.6.1 and 1.5.4 are released mailing-list
- https://github.com/golang/go/issues/14959
- [oss-security] 20160405 CVE request - Go - DLL loading, Big int mailing-list
- https://go-review.googlesource.com/#/c/21428/