Lucene search
Gentoo FoundationGLSA-201412-38HistoryDec 26, 2014 - 12:00 a.m.
Icecast: Multiple Vulnerabilities
2014-12-2600:00:00
Gentoo Foundation
security.gentoo.org
14
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.02 Low
EPSS
Percentile
88.9%
Background
Icecast is an open source alternative to SHOUTcast that supports MP3, OGG (Vorbis/Theora) and AAC streaming.
Description
Two vulnerabilities have been discovered in Icecast:
- Icecast does not properly handle shared file descriptors (CVE-2014-9018)
- Supplementary group privileges are not changed (CVE-2014-9091)
Impact
A local attacker can possibly gain escalated privileges or obtain sensitive information.
Workaround
There is no known workaround at this time.
Resolution
All Icecast users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/icecast-2.4.1"
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Gentoo | any | all | net-misc/icecast | < 2.4.1 | UNKNOWN |
Related
nessus
nessus
Fedora 20 : icecast-2.4.1-1.fc20 (2014-16394)
2014-12-15 00:00:00
Fedora 19 : icecast-2.4.1-1.fc19 (2014-16483)
2014-12-15 00:00:00
Fedora 21 : icecast-2.4.1-1.fc21 (2014-16435)
2014-12-15 00:00:00
openvas
openvas
Fedora Update for icecast FEDORA-2014-16394
2014-12-15 00:00:00
Fedora Update for icecast FEDORA-2014-16435
2015-01-05 00:00:00
Fedora Update for icecast FEDORA-2014-16483
2014-12-15 00:00:00
fedora
fedora
[SECURITY] Fedora 20 Update: icecast-2.4.1-1.fc20
2014-12-15 04:36:54
[SECURITY] Fedora 19 Update: icecast-2.4.1-1.fc19
2014-12-15 04:29:38
[SECURITY] Fedora 21 Update: icecast-2.4.1-1.fc21
2014-12-15 04:37:20
nvd
nvd
CVE-2014-9091
2014-12-10 15:59:19
CVE-2014-9018
2014-12-03 18:59:08
cve
cve
CVE-2014-9091
2014-12-10 15:59:19
CVE-2014-9018
2014-12-03 18:59:08
prion
prion
Code injection
2014-12-10 15:59:00
Design/Logic Flaw
2014-12-03 18:59:00
cvelist
cvelist
CVE-2014-9091
2014-12-10 15:00:00
CVE-2014-9018
2014-12-03 18:00:00
ubuntucve
ubuntucve
CVE-2014-9091
2014-12-10 00:00:00
CVE-2014-9018
2014-12-03 00:00:00
debiancve
debiancve
CVE-2014-9091
2014-12-10 15:59:19
CVE-2014-9018
2014-12-03 18:59:08
securityvulns
securityvulns
[ MDVSA-2014:231 ] icecast
2014-11-30 00:00:00
icecast information disclosure
2014-11-30 00:00:00
mageia
mageia
Updated icecast package fixes security vulnerability
2014-11-26 20:29:06
archlinux
archlinux
icecast: information leak
2014-11-28 00:00:00
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.02 Low
EPSS
Percentile
88.9%
Related for GLSA-201412-38