Unscored CVE-2019-9634 EUVD-2019-19004GHSA-jw84-wj3c-4mvvGO-2022-0220

DLL injection on Windows in runtime and syscall

Published Mar 8, 2019 · Updated Aug 4, 2024 · Assigned by mitre

Package: golang Package: stdlib Ecosystem: Azure Linux Ecosystem: Go

Description

Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	golang	No fix yet	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Go	stdlib	< 1.11.10 · >= 1.12.0-0, < 1.12.2	1.11.10, 1.12.2	GO-2022-0220

References

https://github.com/golang/go/issues/30642
107450 vdb-entry
[oss-security] 20190409 DLL injection in Go < 1.12.2 [CVE-2019-9634] mailing-list