Re: Security fix for libtool

[Bob Friesenhahn]

On Tue, 24 Nov 2009, Philipp Thomas wrote:

> I'm maintaining libtool for SuSE/Novell and have a problem where I would
> need help from upstreams.  You just released 2.2.6a to fix the local load
> problem.

You need 2.2.6b (not 'a'!) to fix the problem.

> If the local load problem does affect 1.5.x I need help in coming up with a
> patch as I can't do a version update for older released products.

A patch for 1.5.26 does exist (see 
"http://lists.gnu.org/archive/html/libtool/2009-11/msg00065.html";). 
There is no patch for 1.4.X versions.  All versions of libltdl since 
perhaps late '99 have the issue so this is a good time to try to 
upgrade libltdl to a consistent modern version.  1.5.26 with the patch 
should be modern enough for existing distributions but of course 
updating to libtool 2.2.6b is preferred due to the huge number of 
libtool improvements.

That said, there is cause for concern under Linux, but (usually) no 
need for alarm.

Bob
--
Bob Friesenhahn
address@hidden, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/