Description
GNU libtool before 1.5.2, during compile time, allows local users to overwrite arbitrary files via a symlink attack on libtool directories in /tmp.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libtool | 1.5.6 | — |
| Debian 13 | libtool | 1.5.6 | — |
| Debian 12 | libtool | 1.5.6 | — |
References
- 9530 vdb-entry
- 3795 vdb-entry
- http://www.geocrawler.com/mail/msg.php3?msg_id=3438808&list=405
- libtool-insecure-temp-directory(15017) vdb-entry
- CLA-2004:811 vendor-advisory
- 20040130 Symlink Vulnerability in GNU libtool <1.5.2 mailing-list
- 10777 third-party-advisory