SB2021120738 - Fedora 35 update for golang

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021120738

SB2021120738 - Fedora 35 update for golang

Published: December 7, 2021

Security Bulletin ID SB2021120738
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Buffer overflow (CVE-ID: CVE-2021-38297)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can trigger memory corruption via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.


2) Buffer overflow (CVE-ID: CVE-2021-41771)

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists in debug/macho of the Go standard library when using the debug/macho standard library (stdlib) and malformed binaries are parsed using Open or OpenFat. A remote attacker can send a specially crafted file to perform a denial of service attack.


3) Input validation error (CVE-ID: CVE-2021-41772)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in archive/zip Reader.Open. A remote attacker can pass specially crafted ZIP archive containing an invalid name or an empty filename field to the application and perform a denial of service (DoS) attack.


Remediation

Install update from vendor's website.

References