libtool: libltdl may load and execute code from a library in the current directory

🗓️ 08 Dec 2009 19:00:00Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 11 Views

Libtool may load a local .la file from the current directory, enabling local privilege escalation.

Reporter	Title	Published	Views	Family All 230
FreeBSD	libtool -- Library Search Path Privilege Escalation Issue	25 Nov 200900:00	–	freebsd
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a local malicious individual to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a local malicious individual to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Red Hat Enterprise Linux operating system allows malicious actors to compromise the confidentiality, integrity, and accessibility of protected information.	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Red Hat Enterprise Linux operating system allows malicious actors to compromise the confidentiality, integrity, and accessibility of protected information.	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Red Hat Enterprise Linux operating system allows malicious actors to compromise the confidentiality, integrity, and accessibility of protected information.	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Red Hat Enterprise Linux operating system allows malicious actors to compromise the confidentiality, integrity, and accessibility of protected information.	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Red Hat Enterprise Linux operating system allows malicious actors to compromise the confidentiality, integrity, and accessibility of protected information.	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Red Hat Enterprise Linux operating system allows malicious actors to compromise the confidentiality, integrity, and accessibility of protected information.	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Red Hat Enterprise Linux operating system allows malicious actors to compromise the confidentiality, integrity, and accessibility of protected information.	28 Apr 201500:00	–	bdu_fstec

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	3	i386	libtool	0:1.4.3-7	libtool-0:1.4.3-7.i386.rpm
Red Hat Enterprise Linux	3	ia64	libtool	0:1.4.3-7	libtool-0:1.4.3-7.ia64.rpm
Red Hat Enterprise Linux	3	ppc	libtool	0:1.4.3-7	libtool-0:1.4.3-7.ppc.rpm
Red Hat Enterprise Linux	3	s390	libtool	0:1.4.3-7	libtool-0:1.4.3-7.s390.rpm
Red Hat Enterprise Linux	3	s390x	libtool	0:1.4.3-7	libtool-0:1.4.3-7.s390x.rpm
Red Hat Enterprise Linux	3	x86_64	libtool	0:1.4.3-7	libtool-0:1.4.3-7.x86_64.rpm
Red Hat Enterprise Linux	5	i386	libtool	0:1.5.22-7.el5_4	libtool-0:1.5.22-7.el5_4.i386.rpm
Red Hat Enterprise Linux	5	ia64	libtool	0:1.5.22-7.el5_4	libtool-0:1.5.22-7.el5_4.ia64.rpm
Red Hat Enterprise Linux	5	ppc	libtool	0:1.5.22-7.el5_4	libtool-0:1.5.22-7.el5_4.ppc.rpm
Red Hat Enterprise Linux	5	s390x	libtool	0:1.5.22-7.el5_4	libtool-0:1.5.22-7.el5_4.s390x.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2009-3736
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2009-3736
cve	www.cve.org/CVERecord

25 Jun 2026 10:36Current

7.4High risk

Vulners AI Score7.4

CVSS 26.9

EPSS0.00394

gnu libtool local privilege escalation la file current directory trojan horse risk