Lucene search
Debian Security Bug TrackerDEBIANCVE:CVE-2024-24787HistoryMay 08, 2024 - 4:15 p.m.
CVE-2024-24787
2024-05-0816:15:08
Debian Security Bug Tracker
security-tracker.debian.org
9
darwin
go module
arbitrary code execution
apple version of ld
lto_library flag
unix
CVSS3
6.4
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
AI Score
7.7
Confidence
Low
EPSS
0
Percentile
10.3%
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a “#cgo LDFLAGS” directive.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 11 | all | golang-1.15 | < 1.15.15-1~deb11u4 | golang-1.15_1.15.15-1~deb11u4_all.deb |
| Debian | 12 | all | golang-1.19 | < 1.19.8-2 | golang-1.19_1.19.8-2_all.deb |
| Debian | 999 | all | golang-1.22 | < 1.22.7-1 | golang-1.22_1.22.7-1_all.deb |
| Debian | 13 | all | golang-1.22 | < 1.22.7-1 | golang-1.22_1.22.7-1_all.deb |
Related
osv
osv
CGA-846h-2r7r-7xg8
2024-06-06 12:25:07
CGA-55xw-24g9-jv29
2024-06-06 12:23:58
CGA-h3f3-3g2h-xfxr
2024-06-06 12:27:36
nessus
nessus
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.21 (SUSE-SU-2024:1588-1)
2024-05-11 00:00:00
Golang < 1.21.10, 1.22.x < 1.22.3 Code Execution
2024-05-13 00:00:00
alpinelinux
alpinelinux
CVE-2024-24787
2024-05-08 16:15:08
CVSS3
6.4
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
AI Score
7.7
Confidence
Low
EPSS
0
Percentile
10.3%
Related for DEBIANCVE:CVE-2024-24787