Bug 295535 – <sys-devel/libtool-2.2.6b Insecure .la search path (CVE-2009-3736)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Alex Legler (RETIRED) 2009-12-03 08:59:54 UTC]

CVE-2009-3736 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3736):
  ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b,
  attempts to open a .la file in the current working directory, which
  allows local users to gain privileges via a Trojan horse file.

[Comment 1 Alex Legler (RETIRED) 2009-12-05 21:40:56 UTC]

Forgot to ask... base-system: can we go stable with 2.2.6b?

[Comment 2 SpanKY 2009-12-06 00:01:30 UTC]

i'm not aware of any regressions that would prevent stabilization

[Comment 3 Alex Legler (RETIRED) 2009-12-06 00:05:16 UTC]

Arches, please test and mark stable:
=sys-devel/libtool-2.2.6b
Target keywords : "alpha amd64 arm hppa ia64 m68k ppc ppc64 s390 sh sparc x86"

[Comment 4 Jeroen Roovers (RETIRED) 2009-12-07 05:56:32 UTC]

Stable for HPPA.

[Comment 5 Samuli Suominen (RETIRED) 2009-12-07 06:00:48 UTC]

Stable media-sound/mpg123 first (bug 294106) because otherwise you'd be breaking the stable version... thanks :)

[Comment 6 Tiago Cunha (RETIRED) 2009-12-07 17:17:42 UTC]

sparc stable

[Comment 7 Markus Meier 2009-12-07 23:03:45 UTC]

amd64/arm/x86 stable

[Comment 8 Brent Baude (RETIRED) 2009-12-08 15:19:18 UTC]

ppc64 done

[Comment 9 Jeroen Roovers (RETIRED) 2009-12-09 14:52:56 UTC]

Stable for PPC.

[Comment 10 Raúl Porcel (RETIRED) 2009-12-09 17:46:18 UTC]

alpha/ia64/m68k/s390/sh stable

[Comment 11 Tim Sammut (RETIRED) 2010-11-20 20:28:04 UTC]

GLSA request already filed.

[Comment 12 Sean Amoss (RETIRED) 2014-05-31 22:31:49 UTC]

This issue has been fixed since Dec 09, 2009. No GLSA will be issued.