The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5227-1 advisory.

    This update for go1.26 fixes the following issue:

    Security issues fixed:

    - CVE-2026-97033: `cmd/go`: unexpected code execution via `--sysroot`, `-target`, `-isysroot`,     `-Wl,-syslibroot`, and       `-x cgo` flags (bsc#1289978).
    - CVE-2026-97034: `cmd/go`: arbitrary command execution via GCC spec files in `cgo` linker search     directories       (bsc#1289979).
    - CVE-2026-97035: `cmd/go`: unexpected code execution and arbitrary file write via Clang `-gen-*` and GCC     `-gnat*`       flags in `cgo` (bsc#1289980).
    - CVE-2026-97036: `cmd/go`: arbitrary code execution during build on darwin via `-l to_library` in `cgo`     (bsc#1289981).
    - CVE-2026-97037: `cmd/go`: linker script injection via split `-Wl,` flags and Darwin or symbol linker     flags in `cgo`       (bsc#1289982).
    - CVE-2026-97038: `cmd/go`: arbitrary code execution via crafted `.syso` files and `cgo` linker input     files       (bsc#1289983).
    - CVE-2026-97039: `cmd/go`: flag sanitization bypass via `#cgo pkg-config:` directives (bsc#1289984).
    - CVE-2026-97040: `cmd/go`, `cmd/link`: `cgo` directive injection via `.syso` files disguised as Go object     files       (bsc#1289985).
    - CVE-2026-97041: `cmd/compile`, `cmd/link`: host linker flag injection via `//go:cgo_*` directives     (bsc#1289986).
    - CVE-2026-97042: `cmd/cgo`, `cmd/compile`, `cmd/link`: linker flag injection via `cgo_import_dynamic` and     PE DLL       names (bsc#1289987).
    - CVE-2026-97043: `cmd/go`, `cmd/compile`: unexpected code execution via escaped quotes in     `//go:cgo_ldflag`       (bsc#1289988).
    - CVE-2026-97054: `net/http`: HTTP/1 server crash due to `MaxBytesReader` header race (bsc#1289989).

    Changes for go1.26:

    Update to version go1.26.11 (bsc#1255111):

    - go#81865 `cmd/compile`: `branchelim` optimization can eliminate result of store
    - go#81869 `cmd/compile`: generic shift-by-constant canonicalization gives `Const64` the wrong type
    - go#81926 `cmd/asm`: amd64 assembler loops forever on a forward jump to a labelled `PCALIGN` when a     branch needs       widening
    - go#81946 `net/http`: backport fix to protect against middleware changing server response body
    - go#82022 `net`: `Dialer.Dial{TCP,UDP,IP}` incorrectly treats invalid addresses as `::`
    - go#82149 `runtime`: linux/mips `time64` nanosecond layout causes busy waits and empty CPU profiles
    - go#82333 `cmd/dist`: `GOFIPS140` bootstrap from Go 1.26 fails
    - go#82626 `crypto/fips140`: minor compliance improvements
    - go#82642 `cmd/compile`: ICE on 386 when inlining nested bit rotations (`Int64Lo` not lowered)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5226-1 advisory.

    This update for go1.27 fixes the following issue:

    Security issues fixed:

    - CVE-2026-97033: `cmd/go`: unexpected code execution via `--sysroot`, `-target`, `-isysroot`,     `-Wl,-syslibroot`, and       `-x cgo` flags (bsc#1289978).
    - CVE-2026-97034: `cmd/go`: arbitrary command execution via GCC spec files in `cgo` linker search     directories       (bsc#1289979).
    - CVE-2026-97035: `cmd/go`: unexpected code execution and arbitrary file write via Clang `-gen-*` and GCC     `-gnat*`       flags in `cgo` (bsc#1289980).
    - CVE-2026-97036: `cmd/go`: arbitrary code execution during build on darwin via `-l to_library` in `cgo`     (bsc#1289981).
    - CVE-2026-97037: `cmd/go`: linker script injection via split `-Wl,` flags and Darwin or symbol linker     flags in `cgo`       (bsc#1289982).
    - CVE-2026-97038: `cmd/go`: arbitrary code execution via crafted `.syso` files and `cgo` linker input     files       (bsc#1289983).
    - CVE-2026-97039: `cmd/go`: flag sanitization bypass via `#cgo pkg-config:` directives (bsc#1289984).
    - CVE-2026-97040: `cmd/go`, `cmd/link`: `cgo` directive injection via `.syso` files disguised as Go object     files       (bsc#1289985).
    - CVE-2026-97041: `cmd/compile`, `cmd/link`: host linker flag injection via `//go:cgo_*` directives     (bsc#1289986).
    - CVE-2026-97042: `cmd/cgo`, `cmd/compile`, `cmd/link`: linker flag injection via `cgo_import_dynamic` and     PE DLL       names (bsc#1289987).
    - CVE-2026-97043: `cmd/go`, `cmd/compile`: unexpected code execution via escaped quotes in     `//go:cgo_ldflag`       (bsc#1289988).
    - CVE-2026-97054: `net/http`: HTTP/1 server crash due to `MaxBytesReader` header race (bsc#1289989).

    Changes for go1.27:

    Update to version go1.27.4 (bsc#1272545):

    - go#81866 `cmd/compile`: `branchelim` optimization can eliminate result of store
    - go#81927 `cmd/asm`: amd64 assembler loops forever on a forward jump to a labelled `PCALIGN` when a     branch needs       widening
    - go#82023 `net`: `Dialer.Dial{TCP,UDP,IP}` incorrectly treats invalid addresses as `::`
    - go#82106 `cmd/compile`: `staticcheck` still crashes with generic methods on Go 1.27.2
    - go#82150 `runtime`: linux/mips `time64` nanosecond layout causes busy waits and empty CPU profiles
    - go#82334 `cmd/dist`: `GOFIPS140` bootstrap from Go 1.26 fails
    - go#82536 `crypto/tls`: omit ML-DSA from `signature_algorithms_cert` in Go 1.27CherryPickApproved
    - go#82627 `crypto/fips140`: minor compliance improvements
    - go#82657 `runtime`: nil-pointer panic in a promoted-method wrapper becomes 'traceback did not unwind     completely'       under `-race`

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link     time via untrusted GCC spec files (specs or *.spec). When linking with -fopenmp, -fopenacc, or
    -fsanitize= in #cgo LDFLAGS, GCC's built-in link spec evaluates %:include(libgomp.spec) or     %:include(libsanitizer.spec) and searches for spec files in -L and sysroot directories (including     subdirectories and multilib sibling directories such as ../lib64), as well as the working directory when
    -fopenmp or -fopenacc is used or when -fsanitize= is combined with -static or -static-lib*. The     go command now rejects -L, -isysroot, and -Wl,-syslibroot directories (and the working and package     directories when applicable) that contain GCC spec files, and disallows @ and - prefixes in
    -fsanitize= compiler flag values. (CVE-2026-97034)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Golang running on the remote host is prior to 1.26.11, or 1.27.x prior to 1.27.4. It is, therefore, affected by multiple vulnerabilities in the Go toolchain and standard library, as referenced in the golang-announce advisory.

  - When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link     time via untrusted GCC spec files (specs or *.spec). The go command now rejects -L, -isysroot, and
    -Wl,-syslibroot directories that contain GCC spec files. (CVE-2026-97034)

  - On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the     Apple linker due to passing -l to_library in a #cgo LDFLAGS directive, which the Apple linker recombines     into -lto_library and which loads an arbitrary LTO plugin dynamic library at link time. (CVE-2026-97036)

  - Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing     linker script files to the host linker via #cgo LDFLAGS, because split -Wl, flags that consume a following     argument accepted a bare second argument without a -Wl, prefix. (CVE-2026-97037)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
381221	SUSE SLED15 / SLES15 Security Update : go1.26 (SUSE-SU-2026:5227-1)	Nessus	SuSE Local Security Checks	2026/11/14	2026/11/14	high
381219	SUSE SLED15 / SLES15 Security Update : go1.27 (SUSE-SU-2026:5226-1)	Nessus	SuSE Local Security Checks	2026/11/14	2026/11/14	high
378578	Linux Distros Unpatched Vulnerability : CVE-2026-97034	Nessus	Misc.	2026/11/10	2026/11/13	high
380359	Golang < 1.26.11 / 1.27.x < 1.27.4 Multiple Vulnerabilities	Nessus	Misc.	2026/11/13	2026/11/13	critical

偵測

搜尋 Plugin

high

high

high

critical