CVE-2012-2666

moderate-risk
Published 2021-07-09

golang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym/pclntab_test.go creates a temporary file with predicable name and executes it as shell script.

Do I need to act?

-
0.51% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Go

Affected Vendors

Golang

References (10)

Issue Tracking https://bugzilla.suse.com/show_bug.cgi?id=765455
Exploit https://codereview.appspot.com/5992078
Patch https://github.com/golang/go/commit/8ac275bb01588a8c0e6c0fe2de7fd11f08feccdd
Third Party Advisory https://security.netapp.com/advisory/ntap-20210902-0009/
Third Party Advisory https://www.whitesourcesoftware.com/vulnerability-database/CVE-2012-2666
Issue Tracking https://bugzilla.suse.com/show_bug.cgi?id=765455
Exploit https://codereview.appspot.com/5992078
Patch https://github.com/golang/go/commit/8ac275bb01588a8c0e6c0fe2de7fd11f08feccdd
Third Party Advisory https://security.netapp.com/advisory/ntap-20210902-0009/
Third Party Advisory https://www.whitesourcesoftware.com/vulnerability-database/CVE-2012-2666
39
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 2/34 · Minimal
Exposure 5/34 · Minimal