CVE-2009-3736

CVE-2009-3736 is a medium-severity vulnerability in Gnu Libtool with a CVSS 2.0 base score of 6.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Description

ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibly other products, attempts to open a .la file in the current working directory, which allows local users to gain privileges via a Trojan horse file.

Frequently asked questions

What is CVE-2009-3736?
ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibly other products, attempts to open a .la file in the current working directory, which allows local users to gain privileges via a Trojan horse file.
How severe is CVE-2009-3736?
CVE-2009-3736 has a CVSS 2.0 base score of 6.9, rated medium severity.
Is CVE-2009-3736 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (31st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2009-3736?
CVE-2009-3736 primarily affects Gnu Libtool. In total, 15 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2009-3736?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2009-3736 published?
CVE-2009-3736 was published on 2009-11-29 and last updated on 2026-06-16.

References

Affected products (15)

More vulnerabilities in Gnu Libtool

All CVEs affecting Gnu Libtool →