Summary
[2.17.7-12.0.1.el9_8.1]
- Create mrtg lock file before running restorecon on it [Orabug: 39096845]
[2.17.7-12.1]
- Fix CVE-2026-72694: symlink-following chown of pid file in daemon mode
Resolves: RHEL-236047
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | mrtg | 0:2.17.7-12.0.1.el9_8.1 |
Vulnerabilities 1
-
High 7.1
Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation
A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process …