CVE-2015-8618
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Google Go是美国谷歌（Google）公司的一种针对多处理器系统应用程序的编程进行了优化的编程语言。 Google Go 1.5.3之前1.5.x版本的math/big库中的Int.Exp Montgomery代码存在安全漏洞，该漏洞源于程序没有正确处理进位传递，导致不正确的输出。攻击者可利用该漏洞获取RSA私钥。
Possible ATT&CK Techniques 1 AI
T1595 · Active Scanning
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2015-8618
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
The Int.Exp Montgomery code in the math/big library in Go 1.5.x before 1.5.3 mishandles carry propagation and produces incorrect output, which makes it easier for attackers to obtain private RSA keys via unspecified vectors.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Google Go math/big库安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Google Go是美国谷歌（Google）公司的一种针对多处理器系统应用程序的编程进行了优化的编程语言。 Google Go 1.5.3之前1.5.x版本的math/big库中的Int.Exp Montgomery代码存在安全漏洞，该漏洞源于程序没有正确处理进位传递，导致不正确的输出。攻击者可利用该漏洞获取RSA私钥。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2015-8618
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2015-8618
请登录查看更多情报信息。
Mailing List Discussions for CVE-2015-8618 (6)
-
-
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176179.html vendor-advisory x_refsource_FEDORA
-
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175642.html vendor-advisory x_refsource_FEDORA
-
-
-
Other References for CVE-2015-8618 (2)
-
https://go-review.googlesource.com/#/c/17672/ x_refsource_CONFIRM
-
https://github.com/golang/go/issues/13515 x_refsource_CONFIRM
Same Patch Batch · n/a · 2016-01-27 · 15 CVEs total
| CVE-2015-6319 | Cisco RV220W SQL注入漏洞 | |
| CVE-2015-6421 | Cisco Wide Area Application Services和Virtual WAAS 拒绝服务漏洞 | |
| CVE-2016-1299 | Cisco Small Business SG300 拒绝服务漏洞 | |
| CVE-2016-1300 | Cisco Unity Connection 跨站脚本漏洞 | |
| CVE-2016-1923 | OpenJpeg 基于堆的缓冲区错误漏洞 | |
| CVE-2016-1924 | OpenJPEG 拒绝服务漏洞 | |
| CVE-2016-1982 | Privoxy 拒绝服务漏洞 | |
| CVE-2016-1983 | Privoxy 安全漏洞 | |
| CVE-2016-2047 | MariaDB、Oracle MySQL和Percona Server 安全漏洞 | |
| CVE-2015-7439 | IBM InfoSphere Data Architect 跨站脚本漏洞 | |
| CVE-2015-7487 | IBM Maximo Asset Management 安全漏洞 | |
| CVE-2015-7488 | IBM Spectrum Scale 安全漏洞 | |
| CVE-2016-0209 | IBM WebSphere Portal 跨站脚本漏洞 | |
| CVE-2016-1896 | Lexmark打印机竞争条件漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2015-8618
No comments yet