Synopsis:	Moderate: libtool security update
Issue date:	2009-12-08
CVE Names:	CVE-2009-3736

CVE-2009-3736 libtool: libltdl may load and execute code from a library 
in the current directory

A flaw was found in the way GNU Libtool's libltdl library looked for
modules to load. It was possible for libltdl to load and run modules 
from an arbitrary library in the current working directory. If a local 
attacker could trick a local user into running an application (which 
uses libltdl) from an attacker-controlled directory containing a 
malicious Libtool control file (.la), the attacker could possibly 
execute arbitrary code with the privileges of the user running the 
application. (CVE-2009-3736)

After installing the updated packages, applications using the libltdl 
library must be restarted for the update to take effect.

SL 3.0.x

       SRPMS:
libtool-1.4.3-7.src.rpm
       i386:
libtool-1.4.3-7.i386.rpm
libtool-libs-1.4.3-7.i386.rpm
       x86_64:
libtool-1.4.3-7.x86_64.rpm
libtool-libs-1.4.3-7.i386.rpm
libtool-libs-1.4.3-7.x86_64.rpm

SL 4.x

       SRPMS:
libtool-1.5.6-5.el4_8.src.rpm
       i386:
libtool-1.5.6-5.el4_8.i386.rpm
libtool-libs-1.5.6-5.el4_8.i386.rpm
       x86_64:
libtool-1.5.6-5.el4_8.x86_64.rpm
libtool-libs-1.5.6-5.el4_8.i386.rpm
libtool-libs-1.5.6-5.el4_8.x86_64.rpm

SL 5.x

       SRPMS:
libtool-1.5.22-7.el5_4.src.rpm
       i386:
libtool-1.5.22-7.el5_4.i386.rpm
libtool-ltdl-1.5.22-7.el5_4.i386.rpm
libtool-ltdl-devel-1.5.22-7.el5_4.i386.rpm
       x86_64:
libtool-1.5.22-7.el5_4.x86_64.rpm
libtool-ltdl-1.5.22-7.el5_4.i386.rpm
libtool-ltdl-1.5.22-7.el5_4.x86_64.rpm
libtool-ltdl-devel-1.5.22-7.el5_4.i386.rpm
libtool-ltdl-devel-1.5.22-7.el5_4.x86_64.rpm

-Connie Sieh
-Troy Dawson