Description
ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibly other products, attempts to open a .la file in the current working directory, which allows local users to gain privileges via a Trojan horse file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | clamav | 0.95+dfsg-1 | — |
| Debian 14 | graphicsmagick | 1.3.5-6 | — |
| Debian 14 | graphviz | 2.26.3-14 | — |
| Debian 14 | hamlib | 1.2.10-1 | — |
| Debian 14 | heartbeat | 2.1.4-7 | — |
| Debian 14 | hercules | 3.06-1.2 | — |
| Debian 14 | hypre | 2.4.0b-5 | — |
| Debian 14 | imagemagick | 6:6.2.3.1-1 | — |
| Debian 14 | jags | 1.0.4-1 | — |
| Debian 14 | lam | 7.1.2-1.6 | — |
| Debian 14 | libextractor | 0.5.23+dfsg-4 | — |
| Debian 14 | libtool | 2.2.6b-1 | — |
| Debian 14 | mp4h | 1.3.1-4.1 | — |
| Debian 14 | openmpi | 1.3.3-4 | — |
| Debian 14 | parser | 3.4.0-2 | — |
| Debian 14 | parser-mysql | 10.3-2 | — |
| Debian 14 | pinball | 0.3.1-11 | — |
| Debian 14 | redland | 1.0.10-1 | — |
| Debian 14 | sdcc | 2.9.0-5 | — |
| Debian 14 | synfig | 0.62.00-1 | — |
| Debian 14 | xmlsec1 | 1.2.14-1 | — |
| Debian 13 | clamav | 0.95+dfsg-1 | — |
| Debian 13 | collectd | 4.8.2-1 | — |
| Debian 13 | graphicsmagick | 1.3.5-6 | — |
| Debian 13 | graphviz | 2.26.3-14 | — |
| Debian 13 | hamlib | 1.2.10-1 | — |
| Debian 13 | heartbeat | 2.1.4-7 | — |
| Debian 13 | hercules | 3.06-1.2 | — |
| Debian 13 | hypre | 2.4.0b-5 | — |
| Debian 13 | imagemagick | 6:6.2.3.1-1 | — |
| Debian 13 | jags | 1.0.4-1 | — |
| Debian 13 | lam | 7.1.2-1.6 | — |
| Debian 13 | libextractor | 0.5.23+dfsg-4 | — |
| Debian 13 | libtool | 2.2.6b-1 | — |
| Debian 13 | mp4h | 1.3.1-4.1 | — |
| Debian 13 | openmpi | 1.3.3-4 | — |
| Debian 13 | parser | 3.4.0-2 | — |
| Debian 13 | parser-mysql | 10.3-2 | — |
| Debian 13 | pinball | 0.3.1-11 | — |
| Debian 13 | redland | 1.0.10-1 | — |
| Debian 13 | sdcc | 2.9.0-5 | — |
| Debian 13 | xmlsec1 | 1.2.14-1 | — |
| Debian 12 | clamav | 0.95+dfsg-1 | — |
| Debian 12 | collectd | 4.8.2-1 | — |
| Debian 12 | ggobi | 2.1.9~20091212-1 | — |
| Debian 12 | graphicsmagick | 1.3.5-6 | — |
| Debian 12 | graphviz | 2.26.3-14 | — |
| Debian 12 | hamlib | 1.2.10-1 | — |
| Debian 12 | heartbeat | 2.1.4-7 | — |
| Debian 12 | hercules | 3.06-1.2 | — |
| Debian 12 | hypre | 2.4.0b-5 | — |
| Debian 12 | imagemagick | 6:6.2.3.1-1 | — |
| Debian 12 | jags | 1.0.4-1 | — |
| Debian 12 | lam | 7.1.2-1.6 | — |
| Debian 12 | libextractor | 0.5.23+dfsg-4 | — |
| Debian 12 | libprelude | 0.9.14-2 | — |
| Debian 12 | libtool | 2.2.6b-1 | — |
| Debian 12 | mp4h | 1.3.1-4.1 | — |
| Debian 12 | openmpi | 1.3.3-4 | — |
| Debian 12 | parser | 3.4.0-2 | — |
| Debian 12 | parser-mysql | 10.3-2 | — |
| Debian 12 | pinball | 0.3.1-11 | — |
| Debian 12 | redland | 1.0.10-1 | — |
| Debian 12 | sdcc | 2.9.0-5 | — |
| Debian 12 | synfig | 0.62.00-1 | — |
| Debian 12 | xmlsec1 | 1.2.14-1 | — |
| Debian 5.0 | libtool | 1.5.26-4+lenny1 | DSA-1958-1 |
| Debian 4.0 | libtool | 1.5.22-4+etch1 | DSA-1958-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | cpp +18 | 4.1.2-46.el5_4.2 | RHSA-2010:0039 |
| RHEL 5 | libtool +2 | 1.5.22-7.el5_4 | RHSA-2009:1646 |
| RHEL 4 | cpp +16 | 3.4.6-11.el4_8.1 | RHSA-2010:0039 |
| RHEL 4 | gcc4 +10 | 4.1.2-44.EL4_8.1 | RHSA-2010:0039 |
| RHEL 4 | libtool +1 | 1.5.6-5.el4_8 | RHSA-2009:1646 |
| RHEL 3 | cpp +16 | 3.2.3-60 | RHSA-2010:0039 |
| RHEL 3 | libtool +1 | 1.4.3-7 | RHSA-2009:1646 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | GraphicsMagick | 1.3.25-1.1 | openSUSE-SU-2024:10505-1 |
Advisories 4
- RHSA-2010:0039 Red Hat Security Advisory: gcc and gcc4 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1646 Red Hat Security Advisory: libtool security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1958-1 libtool - privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10505-1 GraphicsMagick-1.3.25-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- GLSA-201311-10 vendor-advisory
- MDVSA-2010:105 vendor-advisory
- FEDORA-2010-1872 vendor-advisory
- MDVSA-2010:091 vendor-advisory
- http://support.avaya.com/css/P8/documents/100074869
- 39299 third-party-advisory
- 38577 third-party-advisory
- 38617 third-party-advisory
- MDVSA-2010:035 vendor-advisory
- 37414 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=537941
- http://hamlib.svn.sourceforge.net/viewvc/hamlib/trunk/libltdl/Makefile.am?revision=2841&view=markup
- 55721 third-party-advisory
- FEDORA-2010-1924 vendor-advisory
- 38190 third-party-advisory
- oval:org.mitre.oval:def:6951 vdb-entry signature
- http://git.savannah.gnu.org/cgit/libtool.git/commit/?h=branch-1-5&id=29b48580df75f0c5baa2962548a4c101ec7ed7ec
- FEDORA-2009-12813 vendor-advisory
- FEDORA-2011-1967 vendor-advisory
- RHSA-2010:0039 vendor-advisory
- MDVSA-2009:307 vendor-advisory
- SUSE-SR:2010:006 vendor-advisory
- FEDORA-2011-1990 vendor-advisory
- 43617 third-party-advisory
- FEDORA-2011-1958 vendor-advisory
- [libtool] 20091116 GNU Libtool 2.2.6b released mailing-list
- ADV-2011-0574 vdb-entry
- 37128 vdb-entry
- [libtool] 20091116 Backport of libltdl changes to branch-1-5 mailing-list
- 37489 third-party-advisory
- 39347 third-party-advisory
- RHSA-2010:0095 vendor-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- oval:org.mitre.oval:def:11687 vdb-entry signature
- 38696 third-party-advisory
- 37997 third-party-advisory
- 38915 third-party-advisory