CVE-2016-3958

    Dashboard / Vulnerabilities / CVE-2016-3958

    CVE-2016-3958

    Published: 23 May 2016Last Modified: 8 Jul 2026
    Aliases:
    GO-2021-0163

    Summary:

    Details: Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the current working directory, related to use of the LoadLibrary function.

    References: https://groups.google.com/forum/#%21topic/golang-announce/9eqIHqaWvck, http://www.openwall.com/lists/oss-security/2016/04/05/1, http://www.openwall.com/lists/oss-security/2016/04/05/2, https://github.com/golang/go/issues/14959, https://go-review.googlesource.com/#/c/21428/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- bb03defe933c89fee44be675d7aa0fbd893ced30
    Fixed -a1ef950a15517bca223d079a6cf65948c3db9694

    Affected versions

    go1.6

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2016-3958 | CVE-DB