Icecast: Multiple Vulnerabilities

Icecast: Multiple Vulnerabilities Two vulnerabilities have been found in Icecast, possibly resulting in privilege escalation or disclosure of information. icecast 2014-12-26 2014-12-26 529956 530784 local, remote 2.4.1 2.4.1

Icecast is an open source alternative to SHOUTcast that supports MP3, OGG (Vorbis/Theora) and AAC streaming.

Two vulnerabilities have been discovered in Icecast:

Icecast does not properly handle shared file descriptors (CVE-2014-9018)
Supplementary group privileges are not changed (CVE-2014-9091)

A local attacker can possibly gain escalated privileges or obtain sensitive information.

There is no known workaround at this time.

All Icecast users should upgrade to the latest version:


      # emerge --sync
      # emerge --ask --oneshot --verbose ">=net-misc/icecast-2.4.1"

CVE-2014-9018 CVE-2014-9091 BlueKnight ackle