Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
CVE-2009-3736: GNU Libtool may let local user elevate privileges
CVE-2009-3736 · published 16 years ago
Summary
The libltdl component of GNU Libtool (versions 1.5.x and early 2.2.6) can be tricked into loading a malicious .la file placed in the program's working folder. This could let a local user run code with higher rights than intended. Update to the latest Libtool release or apply the vendor's patch to stop the unsafe file loading.
What to do
- Update debian clamav to version 0.95+dfsg-1.
- Update debian collectd to version 4.8.2-1.
- Update debian ggobi to version 2.1.9~20091212-1.
- Update debian gnu-smalltalk to version 3.1-2.
- Update debian graphicsmagick to version 1.3.5-6.
- Update debian graphviz to version 2.26.3-14.
- Update debian hamlib to version 1.2.10-1.
- Update debian heartbeat to version 2.1.4-7.
- Update debian hercules to version 3.06-1.2.
- Update debian hypre to version 2.4.0b-5.
- Update debian imagemagick to version 6:6.2.3.1-1.
- Update debian jags to version 1.0.4-1.
- Update debian lam to version 7.1.2-1.6.
- Update debian libextractor to version 0.5.23+dfsg-4.
- Update debian libprelude to version 0.9.14-2.
- Update debian libtool to version 2.2.6b-1.
- Update debian mp4h to version 1.3.1-4.1.
- Update debian openmpi to version 1.3.3-4.
- Update debian parser to version 3.4.0-2.
- Update debian parser-mysql to version 10.3-2.
- Update debian pinball to version 0.3.1-11.
- Update debian redland to version 1.0.10-1.
- Update debian sdcc to version 2.9.0-5.
- Update debian synfig to version 0.62.00-1.
- Update debian xmlsec1 to version 1.2.14-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | clamav |
< 0.95+dfsg-1 Fix: upgrade to 0.95+dfsg-1
|
| Debian:12 | debian | clamav |
< 0.95+dfsg-1 Fix: upgrade to 0.95+dfsg-1
|
| Debian:13 | debian | clamav |
< 0.95+dfsg-1 Fix: upgrade to 0.95+dfsg-1
|
| Debian:14 | debian | clamav |
< 0.95+dfsg-1 Fix: upgrade to 0.95+dfsg-1
|
| Debian:11 | debian | collectd |
< 4.8.2-1 Fix: upgrade to 4.8.2-1
|
| Debian:12 | debian | collectd |
< 4.8.2-1 Fix: upgrade to 4.8.2-1
|
| Debian:13 | debian | collectd |
< 4.8.2-1 Fix: upgrade to 4.8.2-1
|
| Debian:11 | debian | ggobi |
< 2.1.9~20091212-1 Fix: upgrade to 2.1.9~20091212-1
|
| Debian:12 | debian | ggobi |
< 2.1.9~20091212-1 Fix: upgrade to 2.1.9~20091212-1
|
| Debian:11 | debian | gnu-smalltalk |
< 3.1-2 Fix: upgrade to 3.1-2
|
| Debian:11 | debian | graphicsmagick |
< 1.3.5-6 Fix: upgrade to 1.3.5-6
|
| Debian:12 | debian | graphicsmagick |
< 1.3.5-6 Fix: upgrade to 1.3.5-6
|
| Debian:13 | debian | graphicsmagick |
< 1.3.5-6 Fix: upgrade to 1.3.5-6
|
| Debian:14 | debian | graphicsmagick |
< 1.3.5-6 Fix: upgrade to 1.3.5-6
|
| Debian:11 | debian | graphviz |
< 2.26.3-14 Fix: upgrade to 2.26.3-14
|
| Debian:12 | debian | graphviz |
< 2.26.3-14 Fix: upgrade to 2.26.3-14
|
| Debian:13 | debian | graphviz |
< 2.26.3-14 Fix: upgrade to 2.26.3-14
|
| Debian:14 | debian | graphviz |
< 2.26.3-14 Fix: upgrade to 2.26.3-14
|
| Debian:11 | debian | hamlib |
< 1.2.10-1 Fix: upgrade to 1.2.10-1
|
| Debian:12 | debian | hamlib |
< 1.2.10-1 Fix: upgrade to 1.2.10-1
|
| Debian:13 | debian | hamlib |
< 1.2.10-1 Fix: upgrade to 1.2.10-1
|
| Debian:14 | debian | hamlib |
< 1.2.10-1 Fix: upgrade to 1.2.10-1
|
| Debian:11 | debian | heartbeat |
< 2.1.4-7 Fix: upgrade to 2.1.4-7
|
| Debian:12 | debian | heartbeat |
< 2.1.4-7 Fix: upgrade to 2.1.4-7
|
| Debian:13 | debian | heartbeat |
< 2.1.4-7 Fix: upgrade to 2.1.4-7
|
| Debian:14 | debian | heartbeat |
< 2.1.4-7 Fix: upgrade to 2.1.4-7
|
| Debian:11 | debian | hercules |
< 3.06-1.2 Fix: upgrade to 3.06-1.2
|
| Debian:12 | debian | hercules |
< 3.06-1.2 Fix: upgrade to 3.06-1.2
|
| Debian:13 | debian | hercules |
< 3.06-1.2 Fix: upgrade to 3.06-1.2
|
| Debian:14 | debian | hercules |
< 3.06-1.2 Fix: upgrade to 3.06-1.2
|
| Debian:11 | debian | hypre |
< 2.4.0b-5 Fix: upgrade to 2.4.0b-5
|
| Debian:12 | debian | hypre |
< 2.4.0b-5 Fix: upgrade to 2.4.0b-5
|
| Debian:13 | debian | hypre |
< 2.4.0b-5 Fix: upgrade to 2.4.0b-5
|
| Debian:14 | debian | hypre |
< 2.4.0b-5 Fix: upgrade to 2.4.0b-5
|
| Debian:11 | debian | imagemagick |
< 6:6.2.3.1-1 Fix: upgrade to 6:6.2.3.1-1
|
| Debian:12 | debian | imagemagick |
< 6:6.2.3.1-1 Fix: upgrade to 6:6.2.3.1-1
|
| Debian:13 | debian | imagemagick |
< 6:6.2.3.1-1 Fix: upgrade to 6:6.2.3.1-1
|
| Debian:14 | debian | imagemagick |
< 6:6.2.3.1-1 Fix: upgrade to 6:6.2.3.1-1
|
| Debian:11 | debian | jags |
< 1.0.4-1 Fix: upgrade to 1.0.4-1
|
| Debian:12 | debian | jags |
< 1.0.4-1 Fix: upgrade to 1.0.4-1
|
| Debian:13 | debian | jags |
< 1.0.4-1 Fix: upgrade to 1.0.4-1
|
| Debian:14 | debian | jags |
< 1.0.4-1 Fix: upgrade to 1.0.4-1
|
| Debian:11 | debian | lam |
< 7.1.2-1.6 Fix: upgrade to 7.1.2-1.6
|
| Debian:12 | debian | lam |
< 7.1.2-1.6 Fix: upgrade to 7.1.2-1.6
|
| Debian:13 | debian | lam |
< 7.1.2-1.6 Fix: upgrade to 7.1.2-1.6
|
| Debian:14 | debian | lam |
< 7.1.2-1.6 Fix: upgrade to 7.1.2-1.6
|
| Debian:11 | debian | libextractor |
< 0.5.23+dfsg-4 Fix: upgrade to 0.5.23+dfsg-4
|
| Debian:12 | debian | libextractor |
< 0.5.23+dfsg-4 Fix: upgrade to 0.5.23+dfsg-4
|
| Debian:13 | debian | libextractor |
< 0.5.23+dfsg-4 Fix: upgrade to 0.5.23+dfsg-4
|
| Debian:14 | debian | libextractor |
< 0.5.23+dfsg-4 Fix: upgrade to 0.5.23+dfsg-4
|
Showing 50 of 92. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | libprelude |
< 0.9.14-2 Fix: upgrade to 0.9.14-2
|
| Debian:12 | debian | libprelude |
< 0.9.14-2 Fix: upgrade to 0.9.14-2
|
| Debian:11 | debian | libtool |
< 2.2.6b-1 Fix: upgrade to 2.2.6b-1
|
| Debian:12 | debian | libtool |
< 2.2.6b-1 Fix: upgrade to 2.2.6b-1
|
| Debian:13 | debian | libtool |
< 2.2.6b-1 Fix: upgrade to 2.2.6b-1
|
| Debian:14 | debian | libtool |
< 2.2.6b-1 Fix: upgrade to 2.2.6b-1
|
| Debian:11 | debian | mp4h |
< 1.3.1-4.1 Fix: upgrade to 1.3.1-4.1
|
| Debian:12 | debian | mp4h |
< 1.3.1-4.1 Fix: upgrade to 1.3.1-4.1
|
| Debian:13 | debian | mp4h |
< 1.3.1-4.1 Fix: upgrade to 1.3.1-4.1
|
| Debian:14 | debian | mp4h |
< 1.3.1-4.1 Fix: upgrade to 1.3.1-4.1
|
| Debian:11 | debian | openmpi |
< 1.3.3-4 Fix: upgrade to 1.3.3-4
|
| Debian:12 | debian | openmpi |
< 1.3.3-4 Fix: upgrade to 1.3.3-4
|
| Debian:13 | debian | openmpi |
< 1.3.3-4 Fix: upgrade to 1.3.3-4
|
| Debian:14 | debian | openmpi |
< 1.3.3-4 Fix: upgrade to 1.3.3-4
|
| Debian:11 | debian | parser |
< 3.4.0-2 Fix: upgrade to 3.4.0-2
|
| Debian:12 | debian | parser |
< 3.4.0-2 Fix: upgrade to 3.4.0-2
|
| Debian:13 | debian | parser |
< 3.4.0-2 Fix: upgrade to 3.4.0-2
|
| Debian:14 | debian | parser |
< 3.4.0-2 Fix: upgrade to 3.4.0-2
|
| Debian:11 | debian | parser-mysql |
< 10.3-2 Fix: upgrade to 10.3-2
|
| Debian:12 | debian | parser-mysql |
< 10.3-2 Fix: upgrade to 10.3-2
|
| Debian:13 | debian | parser-mysql |
< 10.3-2 Fix: upgrade to 10.3-2
|
| Debian:14 | debian | parser-mysql |
< 10.3-2 Fix: upgrade to 10.3-2
|
| Debian:11 | debian | pinball |
< 0.3.1-11 Fix: upgrade to 0.3.1-11
|
| Debian:12 | debian | pinball |
< 0.3.1-11 Fix: upgrade to 0.3.1-11
|
| Debian:13 | debian | pinball |
< 0.3.1-11 Fix: upgrade to 0.3.1-11
|
| Debian:14 | debian | pinball |
< 0.3.1-11 Fix: upgrade to 0.3.1-11
|
| Debian:11 | debian | redland |
< 1.0.10-1 Fix: upgrade to 1.0.10-1
|
| Debian:12 | debian | redland |
< 1.0.10-1 Fix: upgrade to 1.0.10-1
|
| Debian:13 | debian | redland |
< 1.0.10-1 Fix: upgrade to 1.0.10-1
|
| Debian:14 | debian | redland |
< 1.0.10-1 Fix: upgrade to 1.0.10-1
|
| Debian:11 | debian | sdcc |
< 2.9.0-5 Fix: upgrade to 2.9.0-5
|
| Debian:12 | debian | sdcc |
< 2.9.0-5 Fix: upgrade to 2.9.0-5
|
| Debian:13 | debian | sdcc |
< 2.9.0-5 Fix: upgrade to 2.9.0-5
|
| Debian:14 | debian | sdcc |
< 2.9.0-5 Fix: upgrade to 2.9.0-5
|
| Debian:11 | debian | synfig |
< 0.62.00-1 Fix: upgrade to 0.62.00-1
|
| Debian:12 | debian | synfig |
< 0.62.00-1 Fix: upgrade to 0.62.00-1
|
| Debian:14 | debian | synfig |
< 0.62.00-1 Fix: upgrade to 0.62.00-1
|
| Debian:11 | debian | xmlsec1 |
< 1.2.14-1 Fix: upgrade to 1.2.14-1
|
| Debian:12 | debian | xmlsec1 |
< 1.2.14-1 Fix: upgrade to 1.2.14-1
|
| Debian:13 | debian | xmlsec1 |
< 1.2.14-1 Fix: upgrade to 1.2.14-1
|
| Debian:14 | debian | xmlsec1 |
< 1.2.14-1 Fix: upgrade to 1.2.14-1
|
| – | gnu | libtool |
1.5 1.5.2 1.5.4 1.5.6 1.5.8 1.5.10 1.5.12 1.5.14 1.5.16 1.5.18 1.5.20 1.5.22 3 more version ranges
cpe:2.3:a:gnu:libtool:1.5:*:*:*:*:*:*:* |
Original advisory text
ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibly other products, attempts to open a .la file in the current working directory...
ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibly other products, attempts to open a .la file in the current working directory, which allows local users to gain privileges via a Trojan horse file.
References
- https://security-tracker.debian.org/tracker/CVE-2009-3736 Vendor Advisory
- http://secunia.com/advisories/38577
- http://secunia.com/advisories/38617
- http://secunia.com/advisories/38696
- http://secunia.com/advisories/38915
- http://secunia.com/advisories/39299
- http://secunia.com/advisories/39347
- http://secunia.com/advisories/43617
- http://secunia.com/advisories/55721
- http://security.gentoo.org/glsa/glsa-201311-10.xml
- http://support.avaya.com/css/P8/documents/100074869
- http://git.savannah.gnu.org/cgit/libtool.git/commit/?h=branch-1-5&id=29b48580df7... Patch
- http://hamlib.svn.sourceforge.net/viewvc/hamlib/trunk/libltdl/Makefile.am?revisi...
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035133.h...
- http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035168.h...
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054656.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054915.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054921.html
- http://lists.gnu.org/archive/html/libtool/2009-11/msg00059.html Patch
- http://lists.gnu.org/archive/html/libtool/2009-11/msg00065.html Patch
- http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
- http://secunia.com/advisories/37414 Vendor Advisory
- http://secunia.com/advisories/37489 Vendor Advisory
- http://secunia.com/advisories/37997
- http://secunia.com/advisories/38190
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:307
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:035
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:091
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:105
- http://www.redhat.com/support/errata/RHSA-2010-0039.html
- http://www.securityfocus.com/bid/37128 Patch
- http://www.vupen.com/english/advisories/2011/0574
- https://bugzilla.redhat.com/show_bug.cgi?id=537941 Patch
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3...
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3...
- https://rhn.redhat.com/errata/RHSA-2010-0095.html
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01512.h...
Severity
6.9
Medium
Timeline
Published29 Nov 2009
Updated4 Nov 2026
First seen26 Aug 2026
Track software like this
Free during beta