Code:  static FILE *open_log_file(void)
 {
 	if(log_fp) /* keep it open unless we rotate */
 		return log_fp;
 
	log_fp = fopen(log_file, "a+");
 	if(log_fp == NULL) {
		if (daemon_mode == FALSE) {
 			printf("Warning: Cannot open log file '%s' for writing\n", log_file);
			}
 		return NULL;
 		}
 
 	(void)fcntl(fileno(log_fp), F_SETFD, FD_CLOEXEC);
 	return log_fp;
 }

Vulnerability Type: +Priv 
CWE ID: CWE-264
Summary: base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file.  NOTE: this can be leveraged by remote attackers using CVE-2016-9565.
Commit Message: Merge branch 'maint'