CVE-2016-3958

High

Published: 23/05/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

On Windows, in Go versions before 1.5.4 and 1.6.x before 1.6.1, there is an untrusted search path vulnerability. This allows local users to gain privileges via a Trojan horse DLL in the current working directory.

Risk Assessment

This vulnerability may lead to privilege escalation by local users, posing a serious security threat to the system.

Recommendation

It is recommended to update Go to version 1.5.4 or 1.6.1 and to monitor working directories for malicious DLL files.

Other vulnerabilities in Go programming language

CVE-2017-15041Critical
Go versions before 1.8.4 and 1.9.x before 1.9.1 allow remote command execution via 'go get'. By using custom domains, it is possible to configure repositories in a way that can exploit malicious code.

Original NVD description (English source)

Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the current working directory, related to use of the LoadLibrary function.