CVE-2009-3736

ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibly other products, attempts to open a .la file in the current working directory, which allows local users to gain privileges via a Trojan horse file.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.9 UNKNOWN
LOCAL
MEDIUM
AV:L/AC:M/Au:N/C:C/I:C/A:C
certccCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 28%
VendorProductVersion
gnulibtool
1.5
gnulibtool
1.5.2
gnulibtool
1.5.4
gnulibtool
1.5.6
gnulibtool
1.5.8
gnulibtool
1.5.10
gnulibtool
1.5.12
gnulibtool
1.5.14
gnulibtool
1.5.16
gnulibtool
1.5.18
gnulibtool
1.5.20
gnulibtool
1.5.22
gnulibtool
1.5.24
gnulibtool
1.5.26
gnulibtool
2.2.6a:a
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
bochs
bullseye
2.6.11+dfsg-4
fixed
lenny
no-dsa
etch
no-dsa
bookworm
2.7+dfsg-4
fixed
sid
2.8+dfsg-2
fixed
trixie
2.8+dfsg-2
fixed
clamav
bullseye
0.103.10+dfsg-0+deb11u1
fixed
lenny
no-dsa
etch
no-dsa
bookworm
1.0.5+dfsg-1~deb12u1
fixed
sid
1.4.1+dfsg-1
fixed
trixie
1.4.1+dfsg-1
fixed
collectd
bullseye
5.12.0-7
fixed
lenny
no-dsa
etch
no-dsa
bookworm
5.12.0-14
fixed
sid
5.12.0-20
fixed
ggobi
bookworm
2.1.11-2
fixed
bullseye
2.1.11-2
fixed
lenny
no-dsa
etch
no-dsa
sid
2.1.12-1
fixed
trixie
2.1.12-1
fixed
gnu-smalltalk
bullseye
3.2.5-1.3
fixed
lenny
no-dsa
etch
no-dsa
graphicsmagick
bullseye (security)
1.4+really1.3.36+hg16481-2+deb11u1
fixed
bullseye
1.4+really1.3.36+hg16481-2+deb11u1
fixed
lenny
no-dsa
etch
no-dsa
bookworm
1.4+really1.3.40-4
fixed
sid
1.4+really1.3.45-1
fixed
trixie
1.4+really1.3.45-1
fixed
graphviz
bullseye
2.42.2-5+deb11u1
fixed
lenny
no-dsa
etch
no-dsa
bookworm
2.42.2-7+deb12u1
fixed
sid
2.42.4-2
fixed
trixie
2.42.4-2
fixed
hamlib
bullseye
4.0-7
fixed
lenny
no-dsa
etch
no-dsa
bookworm
4.5.4-1
fixed
sid
4.5.5-4
fixed
trixie
4.5.5-4
fixed
heartbeat
bullseye
1:3.0.6-11+deb11u1
fixed
lenny
no-dsa
etch
no-dsa
bookworm
1:3.0.6-13
fixed
sid
1:3.0.6-15
fixed
trixie
1:3.0.6-15
fixed
hercules
bookworm
3.13-7
fixed
bullseye
3.13-7
fixed
lenny
no-dsa
etch
no-dsa
sid
3.13-8
fixed
trixie
3.13-8
fixed
hypre
bullseye
2.18.2-1
fixed
lenny
no-dsa
etch
no-dsa
bookworm
2.26.0-3
fixed
trixie
2.31.0-2
fixed
sid
2.31.0-3
fixed
imagemagick
bullseye
8:6.9.11.60+dfsg-1.3+deb11u4
fixed
lenny
no-dsa
etch
no-dsa
bullseye (security)
8:6.9.11.60+dfsg-1.3+deb11u3
fixed
bookworm
8:6.9.11.60+dfsg-1.6+deb12u2
fixed
bookworm (security)
8:6.9.11.60+dfsg-1.6+deb12u1
fixed
trixie
8:6.9.13.12+dfsg1-1
fixed
sid
8:7.1.1.39+dfsg1-2
fixed
jags
bullseye
4.3.0-3
fixed
lenny
no-dsa
etch
no-dsa
bookworm
4.3.1-1
fixed
sid
4.3.2-1
fixed
trixie
4.3.2-1
fixed
lam
bullseye
7.1.4-6.1
fixed
lenny
no-dsa
etch
no-dsa
bookworm
7.1.4-7
fixed
sid
7.1.4-7.2
fixed
trixie
7.1.4-7.2
fixed
libextractor
bullseye
1:1.11-2
fixed
lenny
no-dsa
etch
no-dsa
bookworm
1:1.11-7
fixed
sid
1:1.13-7
fixed
trixie
1:1.13-7
fixed
libmcrypt
bullseye
2.5.8-3.4
fixed
lenny
no-dsa
etch
no-dsa
bookworm
2.5.8-7
fixed
sid
2.5.8-8
fixed
trixie
2.5.8-8
fixed
libprelude
bullseye
5.2.0-3+deb11u1
fixed
lenny
no-dsa
etch
no-dsa
bookworm
5.2.0-5
fixed
sid
5.2.0-5.6
fixed
trixie
5.2.0-5.6
fixed
libtool
bullseye
2.4.6-15
fixed
lenny
no-dsa
etch
no-dsa
bookworm
2.4.7-7~deb12u1
fixed
trixie
2.4.7-7
fixed
sid
2.4.7-8
fixed
mp4h
bookworm
1.3.1-17
fixed
bullseye
1.3.1-17
fixed
lenny
no-dsa
etch
no-dsa
sid
1.3.1-17.1
fixed
trixie
1.3.1-17.1
fixed
openmpi
bullseye
4.1.0-10
fixed
lenny
no-dsa
etch
no-dsa
bookworm
4.1.4-3
fixed
trixie
4.1.6-13.3
fixed
sid
5.0.5-3
fixed
parser
bullseye
3.4.6-2
fixed
lenny
no-dsa
etch
no-dsa
bookworm
3.4.6-3
fixed
sid
3.4.6-5
fixed
trixie
3.4.6-5
fixed
parser-mysql
sid
10.8-3
fixed
trixie
10.8-3
fixed
bookworm
10.8-3
fixed
bullseye
10.8-3
fixed
lenny
no-dsa
etch
no-dsa
pdsh
bullseye
2.31-3
fixed
lenny
no-dsa
etch
no-dsa
bookworm
2.34-0.2
fixed
sid
2.34-3
fixed
trixie
2.34-3
fixed
pinball
bookworm
0.3.20201218-4
fixed
bullseye
0.3.20201218-4
fixed
lenny
no-dsa
etch
no-dsa
sid
0.3.20230219-1
fixed
trixie
0.3.20230219-1
fixed
proftpd-dfsg
bullseye
1.3.7a+dfsg-12+deb11u2
fixed
lenny
no-dsa
etch
no-dsa
bookworm
1.3.8+dfsg-4+deb12u3
fixed
trixie
1.3.8.b+dfsg-2
fixed
sid
1.3.8.b+dfsg-3
fixed
redland
bullseye
1.0.17-1.1
fixed
lenny
no-dsa
etch
no-dsa
bookworm
1.0.17-3
fixed
sid
1.0.17-4
fixed
trixie
1.0.17-4
fixed
sdcc
bullseye
4.0.0+dfsg-2
fixed
lenny
no-dsa
etch
no-dsa
bookworm
4.2.0+dfsg-1
fixed
sid
4.4.0+dfsg-2
fixed
trixie
4.4.0+dfsg-2
fixed
synfig
bullseye
1.4.0+dfsg-2
fixed
lenny
no-dsa
etch
no-dsa
bookworm
1.5.1+dfsg-3
fixed
sid
1.5.1+dfsg-4
fixed
xmlsec1
bullseye
1.2.31-1
fixed
lenny
no-dsa
etch
no-dsa
bookworm
1.2.37-2
fixed
sid
1.2.41-1
fixed
trixie
1.2.41-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libtool
raring
not-affected
quantal
not-affected
precise
not-affected
oneiric
not-affected
natty
not-affected
maverick
not-affected
lucid
not-affected
karmic
ignored
jaunty
ignored
intrepid
ignored
hardy
ignored
dapper
ignored
References