Ryotak

Building a package with a crafted `.syso` file allows the bypass of cgo flag validation to inject arbitrary linker flags during the linking process. This occurs because the linker only verifies recognized host object headers (ELF, Mach-O, PE, and XCOFF) before attempting Go object parsing. If a `.syso` file starts with a `go object` header, it is treated as a Go compiler object, enabling untrusted cgo metadata directives, such as `cgo ldflag` or `cgo dynamic linker`, to be passed to the external linker without validation. Furthermore, `.syso` filenames exceeding 16 bytes lose their extension during truncation in archive headers, and unrecognized `.syso` formats can force external linking in pure-Go builds.

Building a malicious package containing `//go:cgo *` compiler directives can allow the injection of arbitrary flags into the external linker invocation on ELF platforms. This occurs because the compiler and linker failed to reject commas in the `//go:cgo import dynamic`, `//go:cgo export dynamic`, `//go:cgo export static`, `//go:cgo import static`, and `//go:cgo dynamic linker` directives. Additionally, the two-argument form of `//go:cgo import dynamic` could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or a leading `@` could split the `-Wl,--export-dynamic-symbol=` or `-Wl,--dynamic-linker,` arguments into arbitrary host linker flags or response file arguments.

The Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission issue. This flaw allows files within the application installation folder to be tampered with, which can lead to arbitrary code execution.

HTTP/2 servers are susceptible to excessive memory allocation when processing "Trailer" headers sent by a client. The server uses these header values to populate the `Request.Trailer` map, and since each map entry incurs memory overhead, a malicious client can declare a large number of fields to exhaust server resources. This process bypasses the `Server.MaxHeaderValueCount` and `Server.MaxHeaderBytes` limits. This issue does not affect HTTP/1 servers because they do not support multiplexing multiple requests over a single TCP connection and utilize different calculations for `Server.MaxHeaderBytes`.

HTTP/2 servers may crash due to concurrent modification of the HPACK encoder. This occurs when the server modifies the encoder from two goroutines without synchronization: one encoding a HEADERS frame for a client response, and another modifying the encoder table size while processing a SETTINGS frame containing `SETTINGS HEADER TABLE SIZE` sent by a client. A malicious actor can trigger this crash by repeatedly sending requests while simultaneously changing the header table size.

Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be executed within the affected application.

A difference in how Go and C/C++ interpret comments can allow malicious code to be hidden within the compiled binary when using cgo. This technique, known as code smuggling, enables attackers to inject code that may be executed unexpectedly. There is no information available regarding the number of potentially affected devices or any real-world incidents where this issue has been exploited.

A privilege escalation issue exists in the Netmonitor component. This allows for unauthorized access and potential control over the system.

A user with a Developer role can create a database connection using the IBM DB2 driver and, by manipulating LookML, cause Looker to execute a malicious command. This is due to insufficient filtering of the driver’s parameters. This issue affects both Looker-hosted and self-hosted instances. The issue has been mitigated for Looker-hosted instances and does not require user action.

A user with Developer role can create a database connection using the Denodo driver and manipulate LookML to cause Looker to execute a malicious command. This issue affects both Looker-hosted and self-hosted instances. The issue has been mitigated for Looker-hosted instances, requiring no user action.

An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, potentially leading to arbitrary command execution on the Looker instance. This issue affects both Looker-hosted and self-hosted instances. The issue has been mitigated for Looker-hosted instances, requiring no user action.

The standard library’s Path API did not correctly handle path separators on the tier 3 Cygwin target (`x86 64-pc-cygwin`) in versions prior to 1.89.0. This caused the API to ignore path components separated by backslashes. Programs compiled for Cygwin that validate paths could misbehave, potentially allowing path traversal attacks or malicious filesystem operations. The issue was resolved in Rust 1.89.0 by correctly handling both Win32 and Unix style paths for the Cygwin target. The tier 3 Cygwin compilation target is only available when building from source and is not available through pre-built binaries or Rustup.

A cross-site scripting issue exists in NEC Corporation UNIVERGE IX and UNIVERGE IX-R/IX-V. This allows an attacker to inject arbitrary scripts that may be executed in the user's browser.

Untrusted data inclusion in the `pg dump` utility allows a malicious superuser of the origin server to inject arbitrary code. This code is executed during the restore process as the client operating system account running `psql` to restore the dump, achieved through the use of `psql` meta-commands. The `pg dumpall` utility is also affected, as is `pg restore` when it is used to generate a plain-format dump.

A critical vulnerability exists in the Unity Runtime, potentially allowing attackers to execute arbitrary code on systems running applications built with affected versions of the engine. This vulnerability, identified as CVE-2025-59489, stems from an untrusted search path issue, enabling the loading of malicious code through crafted command-line arguments. While primarily a local code execution risk, remote exploitation is possible under specific conditions on Android. No known exploits have been reported to date. The vulnerability affects applications built with Unity versions 2017.1 and later for Windows, Android, macOS, and Linux. Microsoft and Valve have implemented mitigations, and Unity has released patches and a binary patching tool.

Name of the Vulnerable Software and Affected Versions: Go versions prior to 1.24.5 Go versions prior to 1.23.11 Description: The issue concerns unexpected command execution in untrusted VCS repositories when using the Go toolchain. This can occur when the toolchain is used in directories fetched using VCS tools, such as cloning Git or Mercurial repositories. Recommendations: For versions prior to 1.24.5, update to version 1.24.5 to resolve the issue. For versions prior to 1.23.11, update to version 1.23.11 to resolve the issue. As a temporary workaround, consider avoiding the use of the Go toolchain in untrusted VCS repositories until a patch is applied.

A malicious file created using cmd/go can result in a write operation to a file controlled by an attacker, with partial control over the file's content. The issue stems from the use of the '#cgo pkg-config:' directive within Go source files. This directive allows command-line arguments to be passed to the Go pkg-config command. An attacker can exploit this by providing a '--log-file' argument, which causes pkg-config to write output to a location specified by the attacker.

The issue is related to the `content security policy` helper in Action Pack, which may allow an attacker to conduct Cross Site Scripting (XSS) attacks by injecting new directives into the Content-Security-Policy (CSP) headers. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Applications that set CSP headers dynamically from untrusted user input may be vulnerable.

The issue allows an attacker to hijack the authentication of screens on the device via the management interface. This is a Cross-site request forgery (CSRF) vulnerability, which can be exploited to seize control of the device's authentication.

The issue allows an attacker to inject arbitrary CLI commands to be executed on the device via the management interface. This can be done through the administration interface, enabling the execution of commands on the device.