Summary
[2.17.10-12.1]
- Fix symlink-following chown of pid file in daemon mode (CVE-2026-72694)
Resolves: RHEL-236045
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | mrtg | 0:2.17.10-12.el10_2.1 |
| Oracle Linux · 10 | mrtg-selinux | 0:2.17.10-12.el10_2.1 |
Vulnerabilities 1
-
High 7.1
Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation
A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process …