CVE-2012-2666
CRITICAL
9.8
CVSS Score
Published: July 9, 2021 at 10:50 AM UTC
Updated: June 16, 2026 at 11:41 PM UTC
1 product affected across 1 vendorGo
Using go/golang by N/A?
Get instant alerts when new vulnerabilities affect go/golang - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
CRITICAL9.8
Exploit prediction
EPSS 2%
Description
golang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym/pclntab_test.go creates a temporary file with predicable name and executes it as shell script.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (5)
x_refsource_MISCIssue TrackingPatchThird Party Advisory
Source: [email protected]
https://bugzilla.suse.com/show_bug.cgi?id=765455x_refsource_MISCExploitThird Party Advisory
Source: [email protected]
https://codereview.appspot.com/5992078x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://github.com/golang/go/commit/8ac275bb01588a8c0e6c0fe2de7fd11f08feccddx_refsource_CONFIRMThird Party Advisory
Source: [email protected]
https://security.netapp.com/advisory/ntap-20210902-0009/x_refsource_MISCThird Party Advisory
Source: [email protected]
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2012-2666CVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- HIGH
- Availability
- HIGH
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-377
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card