stdlib vulnerabilities

Products

• stdlib 182

Latest stdlib CVEs

Newest publication first · page 8 of 8

1. CVE-2017-1000098 Denial of service when parsing large forms in mime/multipart

   Published 2017-10-04

   High·CVSS 7.5 EPSS 2.1%

   The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors.

2. CVE-2017-8932 Incorrect computation for P-256 curves in crypto/elliptic

   Published 2017-07-06

   Medium·CVSS 5.9 EPSS 2.2%

   A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input...

3. CVE-2016-5386 Improper input validation in net/http and net/http/cgi

   Published 2016-07-19

   High·CVSS 8.1 EPSS 5.2%

   The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to...

4. CVE-2016-3959 Denial of service due to unchecked parameters in crypto/dsa

   Published 2016-05-23

   High·CVSS 7.5 EPSS 4.4%

   The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted public key to a program that uses...

5. CVE-2016-3958 Privilege escalation on Windows via malicious DLL in syscall

   Published 2016-05-23

   High·CVSS 7.8 EPSS 0.40%

   Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the current working directory, related to use of the LoadLibrary function.

6. CVE-2015-8618 Incorrect calculation affecting RSA computations in math/big

   Published 2016-01-27

   High·CVSS 7.5 EPSS 2.6%

   The Int.Exp Montgomery code in the math/big library in Go 1.5.x before 1.5.3 mishandles carry propagation and produces incorrect output, which makes it easier for attackers to obtain private RSA keys via unspecified vectors.

7. CVE-2014-7189 Man-in-the-middle attack with SessionTicketsDisabled in crypto/tls

   Published 2014-10-07

   Medium·CVSS 4.3 EPSS 1.4%

   crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the-middle attackers to spoof clients via unspecified vectors.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.