CVE-2018-18820

Icecast contains a buffer overflow in the URL-auth backend prior to 2.4.4. When URL authentication is enabled, a crafted HTTP header can trigger a denial of service and potentially remote code execution. Public advisories from multiple distros (openSUSE, Fedora, Debian) indicate that updates addr...

CVE-2015-3026

CVE-2015-3026 affects Icecast 2.x up to 2.4.2, where defining a stream_auth handler for URL authentication allows a remote attacker to cause a Denial of Service (NULL pointer dereference) by sending a request without login credentials (e.g., via admin/killsource?mount=/test.ogg). The issue is tri...

CVE-2011-4612

CVE-2011-4612 affects icecast before 2.3.3: remote attackers can inject control characters (e.g., newlines) into the error log via a crafted URL. Multiple advisories (SUSE/openSUSE, Debian OSV, SUSE SU-*) confirm the issue and indicate fixes in updated icecast packages. The OSS advisories list pa...