Stay Secure with the Latest Linux Advisories

security advisorycriticalcode execution

Mageia 9: MGASA-2025-0205 critical: GoLang code execution exploit

Various uses of the Go toolchain in untrusted VCS repositories can result in unexpected code execution. When using the Go toolchain in directories fetched using various VCS tools (such as directly cloning Git or Mercurial repositories) can cause the toolchain to execute unexpected commands, if said directory contains multiple . MGASA-2025-0205 - Updated golang packages fix security vulnerabilities Publication date: 11 Jul 2025 URL: https://advisories.mageia.org/MGASA-2025-0205.html Type: security Affected Mageia releases: 9 CVE: CVE-2025-4674 Various uses of the Go toolchain in untrusted VCS repositories can result in unexpected code execution. When using the Go toolchain in directories fetched using various VCS tools (such as directly cloning Git or Mercurial repositories) can cause the toolchain to execute unexpected commands, if said directory contains multiple VCS configuration metadata (such as a '.hg' directory in a Git repository). This is due to how the Go toolchain attempts to resolve which VCS is being used in order to embed build information in binaries and determine module versions. References: - https://bugs.mageia.org/show_bug.cgi?id=34456 - https://www.openwall.com/lists/oss-security/2025/07/08/5 - https://github.com/golang/go/issues/74382 - https://www.cve.org/CVERecord?id=CVE-2025-4674 SRPMS: - 9/core/golang-1.24.5-1.mga9 . Mageia 9 security bulletin highlights a critical golang flaw enabling unauthorized code execution from untrusted VCS sources.. mageia golang security update code execution risk. . Severity: Critical. LinuxSecurity.com Team

Jul 11, 2025 •Critical Mageia