CVE-2025-63647

A NULL pointer dereference in the parsemeta function src/httpddaap.c of owntone-server commit 334beb allows attackers to cause a Denial of Service DoS via sending a crafted DAAP request to the server...

CVE-2025-63648

A NULL pointer dereference in the dacpreplyplayqueueeditmove function src/httpddacp.c of owntone-server commit b7e385f allows attackers to cause a Denial of Service DoS via sending a crafted DACP request to the server...

CVE-2025-63648

A NULL pointer dereference in the dacpreplyplayqueueeditmove function src/httpddacp.c of owntone-server commit b7e385f allows attackers to cause a Denial of Service DoS via sending a crafted DACP request to the server...

CVE-2025-57155

NULL pointer dereference in the daapreplygroups function in src/httpddaap.c in owntone-server through commit 5e6f19a newer commit after version 28.2 allows remote attackers to cause a Denial of Service...

CVE-2025-57156

The owntone-server media server is vulnerable to a NULL pointer dereference in the dacp_reply_playqueueedit_clear function located in src/httpd_dacp.c. This flaw exists in versions through commit 6d604a1 (newer than version 28.12). A remote attacker can exploit this vulnerability to cause a Denia...

CVE-2025-57155

NULL pointer dereference in the daapreplygroups function in src/httpddaap.c in owntone-server through commit 5e6f19a newer commit after version 28.2 allows remote attackers to cause a Denial of Service...

CVE-2025-63648

The owntone-server media server is vulnerable to a NULL pointer dereference within the dacp_reply_playqueueedit_move function located in src/httpd_dacp.c (specifically in commit b7e385f ). This flaw allows an unauthenticated attacker to trigger a Denial of Service (DoS) condition by sending a spe...

SUSE CVE-2021-38383

OwnTone aka owntone-server through 28.1 has a use-after-free in netbind in misc.c...

Double free

OwnTone aka owntone-server through 28.1 has a use-after-free in netbind in misc.c...

CVE-2021-38383

CVE-2021-38383 affects OwnTone (owntone-server) up to version 28.1, with a use-after-free in net_bind() within misc.c. The NVD data shows CVSSv2 base 7.5 (HIGH) and CVSSv3.1 base 9.8 (CRITICAL), indicating serious impact across network vectors. Connected sources also indicate mitigation: OpenSUSE...