Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 9 Apr 2019 02:26:07 +0200
From: "Jason A. Donenfeld" <>
To: oss-security <>
Subject: DLL injection in Go < 1.12.2 [CVE-2019-9634]

Hey folks,

Golang before 1.12.2 linked against various DLLs that were
same-directory injectable and generally its library loading mechanism
did not use LoadLibraryEx, allowing the classic DLL injection attacks,
especially with regards to executables saved to the Downloads/ folder
[1]. It was assigned CVE-2019-9634 and fixed in [2] and [3]. It wasn't
mentioned in the 1.12.2 release notes, so I'm mentioning it here



Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.