A vulnerability in Icecast might allow remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/icecast | * | < 2.4.4 | >= 2.4.4 |
Icecast is an open source alternative to SHOUTcast that supports MP3, OGG (Vorbis/Theora) and AAC streaming.
Multiple buffer overflows have been discovered in Icecast. Please review the CVE identifier referenced below for details.
A remote attacker, by sending a specially crafted request using authentication type “url”, could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service condition.
There is no known workaround at this time.
All Icecast users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/icecast-2.4.4"
A bug in the Icecast code handling source client URL authentication causes a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/icecast | * | < 2.4.2 | >= 2.4.2 |
Icecast is an open source alternative to shoutcast that supports mp3, ogg (vorbis/theora) and aac streaming.
When stream_auth handler is defined for URL authentication and a request is sent without login credentials, a Denial of Service condition can occur.
A remote attacker could possibly cause a Denial of Service condition.
Users of affected versions can change stream_auth mountpoints to use password authentication instead.
All icecast users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/icecast-2.4.2"
Two vulnerabilities have been found in Icecast, possibly resulting in privilege escalation or disclosure of information.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/icecast | * | < 2.4.1 | >= 2.4.1 |
Icecast is an open source alternative to SHOUTcast that supports MP3, OGG (Vorbis/Theora) and AAC streaming.
Two vulnerabilities have been discovered in Icecast:
A local attacker can possibly gain escalated privileges or obtain sensitive information.
There is no known workaround at this time.
All Icecast users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/icecast-2.4.1"
Icecast is vulnerable to a denial of service attack allowing remote users to crash the application.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/icecast | * | <= 2.0.0 | >= 2.0.1 |
Icecast is a program that streams audio data to listeners over the Internet.
There is an out-of-bounds read error in the web interface of Icecast when handling Basic Authorization requests. This vulnerability can theorically be exploited by sending a specially crafted Authorization header to the server.
By exploiting this vulnerability, it is possible to crash the Icecast server remotely, resulting in a denial of service attack.
There is no known workaround at this time. All users are advised to upgrade to the latest available version of Icecast.
All users of Icecast should upgrade to the latest stable version:
# emerge sync # emerge -pv ">=net-misc/icecast-2.0.1" # emerge ">=net-misc/icecast-2.0.1"