SB2025081425 - SUSE update for go1.24

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025081425

SB2025081425 - SUSE update for go1.24

Published: August 14, 2025

Security Bulletin ID SB2025081425
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2025-47906)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient validation of the PATH environment variable in LookPath. A local user can pass specially crafted strings to the application and execute arbitrary OS commands with elevated privileges. 


2) Race condition (CVE-ID: CVE-2025-47907)

The vulnerability allows an attacker to tamper with the application. 

The vulnerability exists due to a race condition when canceling a DB query. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system. A remote user can overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.


Remediation

Install update from vendor's website.

References