Debian Patches

Status for mrtg/2.17.10-16

Patch Description Author Forwarded Bugs Origin Last update
060_avoid-exit.patch configure.ac: Avoid implicit declaration of the exit function Future C compilers are likely to reject implicit function
declarations by default. This language feature was officially
removed in 1999.
===================================================================		 Florian Weimer <fweimer@redhat.com> no https://github.com/oetiker/mrtg/pull/104 2022-12-16
070_fix-RouterUpTime.patch fix RouterUpTime to accept and to use colon options=================================================================== lukerg <luke@psy.io> yes upstream https://github.com/oetiker/mrtg/pull/106 2023-06-21
080_fix-noHC-yes.patch fix noHC=yes incorrectly inserted by cfgmaker=================================================================== Tobias Oetiker <tobi@oetiker.ch> yes upstream https://github.com/oetiker/mrtg/issues/109 2023-08-29
090_add-ubiquiti.patch add ubiquiti as a vendor with its ID=================================================================== BaptisteRichard <b.richard@circle.dental> no https://github.com/oetiker/mrtg/pull/112 2025-05-19
100_move-polish-to-utf8.patch modified Polish translation from iso-8859-2 to utf-8=================================================================== Piotr Balwierz <balwierz@gmail.com> no https://github.com/oetiker/mrtg/pull/114 2025-01-07
020_fix-privacy-breach.patch fix privacy breach generic via external link=================================================================== Joao Eriberto Mota Filho <eriberto@debian.org> not-needed 2021-10-09
030_disable-joke.patch disable a joke when building A good joke, but it makes build system to freeze for 7 seconds.
===================================================================		 Joao Eriberto Mota Filho <eriberto@debian.org> not-needed 2022-09-09
040_fix-warnings-int.patch Change type of col_XXX[]=================================================================== NAKAJIMA Yusaku <yupong7@gmail.com> yes upstream https://github.com/oetiker/mrtg/pull/103 2022-10-27
050_fix-missing-header.patch include <strings.h> header file=================================================================== NAKAJIMA Yusaku <yupong7@gmail.com> yes upstream https://github.com/oetiker/mrtg/pull/101 2022-10-27
110_fix-CVE-2026-72694.patch Fix symlink-following chown of pid file in daemon mode (CWE-59) .
When mrtg is started as root in daemon mode (--daemon --user), it
created the pid file and chown'ed it to the target user *before*
dropping privileges. Both create_pid()'s `-e`/`open(">...")` and the
subsequent `chown` follow symlinks, so a local attacker who can
pre-place a symlink at the pid path (e.g. a pid file in a writable
directory) could make root chown an arbitrary existing file to the
daemon user, or create a root-owned file at an attacker-chosen path.
.
Rather than reorder the privilege drop (which would break the common
case of a root-owned pid directory, where the unprivileged daemon
cannot create the file itself), keep creating the file while
privileged but do it safely:
.
- create_pid() refuses symlinks and creates the file with
O_WRONLY|O_CREAT|O_EXCL, closing the symlink-follow / TOCTOU window.
- It chowns the open filehandle (fchown) instead of the path, so the
ownership change cannot be redirected through a swapped-in symlink.
The caller no longer does a separate path-based chown.
- demonize_me()'s later pid write refuses symlinks too.
===================================================================		 Tobias Oetiker <tobi@oetiker.ch> yes debian upstream https://github.com/oetiker/mrtg/commit/30e1921 2026-06-30

All known versions for source package 'mrtg'

Links