https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 13 Nov 2026 04:46:49 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-97035 <p>When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via &#34;-gen-*&#34; or &#34;-gnat*&#34; flags in &#34;#cgo&#34; directives. The &#34;-g*&#34; wildcard in the compiler and linker flag allowlists previously matched Clang&#39;s two-argument &#34;-gen-cdb-fragment-path &lt;dir&gt;&#34; flag and GCC&#39;s two-argument &#34;-gnatO &lt;file&gt;&#34; flag, permitting compilation database fragments and sidecar output files to be written to arbitrary directories and desynchronizing flag argument parsing between the go command and the compiler driver so that subsequent arguments could be passed as unvalidated positional inputs to the linker. &#34;-gen-*&#34; and &#34;-gnat*&#34; flags are now disallowed in &#34;#cgo&#34; compiler and linker flags.</p> <p>When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via &#34;-gen-*&#34; or &#34;-gnat*&#34; flags in &#34;#cgo&#34; directives. The &#34;-g*&#34; wildcard in the compiler and linker flag allowlists previously matched Clang&#39;s two-argument &#34;-gen-cdb-fragment-path &lt;dir&gt;&#34; flag and GCC&#39;s two-argument &#34;-gnatO &lt;file&gt;&#34; flag, permitting compilation database fragments and sidecar output files to be written to arbitrary directories and desynchronizing flag argument parsing between the go command and the compiler driver so that subsequent arguments could be passed as unvalidated positional inputs to the linker. &#34;-gen-*&#34; and &#34;-gnat*&#34; flags are now disallowed in &#34;#cgo&#34; compiler and linker flags.</p> https://db.gcve.eu/vuln/fkie_cve-2026-97035 https://db.gcve.eu/vuln/ghsa-6f8j-v7cw-qxpp <p>When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via &#34;-gen-*&#34; or &#34;-gnat*&#34; flags in &#34;#cgo&#34; directives. The &#34;-g*&#34; wildcard in the compiler and linker flag allowlists previously matched Clang&#39;s two-argument &#34;-gen-cdb-fragment-path &lt;dir&gt;&#34; flag and GCC&#39;s two-argument &#34;-gnatO &lt;file&gt;&#34; flag, permitting compilation database fragments and sidecar output files to be written to arbitrary directories and desynchronizing flag argument parsing between the go command and the compiler driver so that subsequent arguments could be passed as unvalidated positional inputs to the linker. &#34;-gen-*&#34; and &#34;-gnat*&#34; flags are now disallowed in &#34;#cgo&#34; compiler and linker flags.</p> <p>When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via &#34;-gen-*&#34; or &#34;-gnat*&#34; flags in &#34;#cgo&#34; directives. The &#34;-g*&#34; wildcard in the compiler and linker flag allowlists previously matched Clang&#39;s two-argument &#34;-gen-cdb-fragment-path &lt;dir&gt;&#34; flag and GCC&#39;s two-argument &#34;-gnatO &lt;file&gt;&#34; flag, permitting compilation database fragments and sidecar output files to be written to arbitrary directories and desynchronizing flag argument parsing between the go command and the compiler driver so that subsequent arguments could be passed as unvalidated positional inputs to the linker. &#34;-gen-*&#34; and &#34;-gnat*&#34; flags are now disallowed in &#34;#cgo&#34; compiler and linker flags.</p> https://db.gcve.eu/vuln/ghsa-6f8j-v7cw-qxpp https://db.gcve.eu/vuln/opensuse-su-2026:12529-1 <p>go1.26-1.26.11-1.1 on GA media</p> <p>go1.26-1.26.11-1.1 on GA media</p> https://db.gcve.eu/vuln/opensuse-su-2026:12529-1 https://db.gcve.eu/vuln/ubuntu-cve-2026-97035 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.8 and 30 more</p> <p>When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via &#34;-gen-*&#34; or &#34;-gnat*&#34; flags in &#34;#cgo&#34; directives. The &#34;-g*&#34; wildcard in the compiler and linker flag allowlists previously matched Clang&#39;s two-argument &#34;-gen-cdb-fragment-path &lt;dir&gt;&#34; flag and GCC&#39;s two-argument &#34;-gnatO &lt;file&gt;&#34; flag, permitting compilation database fragments and sidecar output files to be written to arbitrary directories and desynchronizing flag argument parsing between the go command and the compiler driver so that subsequent arguments could be passed as unvalidated positional inputs to the linker. &#34;-gen-*&#34; and &#34;-gnat*&#34; flags are now disallowed in &#34;#cgo&#34; compiler and linker flags.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.8 and 30 more</p> <p>When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via &#34;-gen-*&#34; or &#34;-gnat*&#34; flags in &#34;#cgo&#34; directives. The &#34;-g*&#34; wildcard in the compiler and linker flag allowlists previously matched Clang&#39;s two-argument &#34;-gen-cdb-fragment-path &lt;dir&gt;&#34; flag and GCC&#39;s two-argument &#34;-gnatO &lt;file&gt;&#34; flag, permitting compilation database fragments and sidecar output files to be written to arbitrary directories and desynchronizing flag argument parsing between the go command and the compiler driver so that subsequent arguments could be passed as unvalidated positional inputs to the linker. &#34;-gen-*&#34; and &#34;-gnat*&#34; flags are now disallowed in &#34;#cgo&#34; compiler and linker flags.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-97035 https://db.gcve.eu/vuln/wid-sec-w-2026-4370 <p>Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.</p> https://db.gcve.eu/vuln/wid-sec-w-2026-4370