CVE-2016-3958

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-3958
Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the current working directory, related to use of the LoadLibrary function.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://www.openwall.com/lists/oss-security/2016/04/05/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/04/05/2 Mailing List Third Party Advisory
https://github.com/golang/go/issues/14959 Third Party Advisory
https://go-review.googlesource.com/#/c/21428/ Vendor Advisory
https://groups.google.com/forum/#%21topic/golang-announce/9eqIHqaWvck
http://www.openwall.com/lists/oss-security/2016/04/05/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/04/05/2 Mailing List Third Party Advisory
https://github.com/golang/go/issues/14959 Third Party Advisory
https://go-review.googlesource.com/#/c/21428/ Vendor Advisory
https://groups.google.com/forum/#%21topic/golang-announce/9eqIHqaWvck
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:golang:go:1.6:*:*:*:*:*:*:*
History

21 Nov 2024, 02:51

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2016/04/05/1 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2016/04/05/1 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2016/04/05/2 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2016/04/05/2 - Mailing List, Third Party Advisory
References () https://github.com/golang/go/issues/14959 - Third Party Advisory () https://github.com/golang/go/issues/14959 - Third Party Advisory
References () https://go-review.googlesource.com/#/c/21428/ - Vendor Advisory () https://go-review.googlesource.com/#/c/21428/ - Vendor Advisory
References () https://groups.google.com/forum/#%21topic/golang-announce/9eqIHqaWvck - () https://groups.google.com/forum/#%21topic/golang-announce/9eqIHqaWvck -

16 Aug 2022, 13:18

Type Values Removed Values Added
References (MLIST) https://groups.google.com/forum/#!topic/golang-announce/9eqIHqaWvck - (MLIST) https://groups.google.com/forum/#!topic/golang-announce/9eqIHqaWvck - Mailing List, Third Party Advisory
References (CONFIRM) https://go-review.googlesource.com/#/c/21428/ - (CONFIRM) https://go-review.googlesource.com/#/c/21428/ - Vendor Advisory
References (MLIST) http://www.openwall.com/lists/oss-security/2016/04/05/2 - (MLIST) http://www.openwall.com/lists/oss-security/2016/04/05/2 - Mailing List, Third Party Advisory
References (CONFIRM) https://github.com/golang/go/issues/14959 - Vendor Advisory (CONFIRM) https://github.com/golang/go/issues/14959 - Third Party Advisory
References (MLIST) http://www.openwall.com/lists/oss-security/2016/04/05/1 - (MLIST) http://www.openwall.com/lists/oss-security/2016/04/05/1 - Mailing List, Third Party Advisory
Information

Published : 2016-05-23 19:59

Updated : 2025-04-12 10:46

NVD link : CVE-2016-3958

Mitre link : CVE-2016-3958

CVE.ORG link : CVE-2016-3958

JSON object : View

Products Affected

golang

  • go
CWE
CWE-264

Permissions, Privileges, and Access Controls