Release date:
2026-09-01 14:30:57 UTC
Description:
- CVE-2026-72694: refuse a symbolic link at the pid file path, create the
file with O_CREAT|O_EXCL and chown the open handle rather than the path.
Started as root in daemon mode, mrtg created and chowned the pid file
before dropping privileges, so a pre-placed symlink could have root
chown an arbitrary file to the daemon user.
Updated packages:
-
mrtg-2.17.7-11.el9_6.tuxcare.els1.x86_64.rpm
sha:ea2a505c57bb2de005c5219dae5b586d327dd948320c0948a01d26f90d9e79af
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
