CVE-2014-9018

Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote...

5.0 MediumFix available

Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors.

Exploit likelihood

2.96%Up 1.0 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors.

Record: CVE-2014-9018
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors.

Record: CVE-2014-9018
Updated: 2026-11-02

EUVDEUVD-2014-8846 No score

Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors.

Record: EUVD-2014-8846
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6r4c-pqmw-f493 No score

Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote...

Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors.

Record: GHSA-6r4c-pqmw-f493
Weakness: CWE-200
Updated: 2026-11-02

OSV No score

Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors.

Record: CVE-2014-9018
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-9018 No score

Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors.

Record: DEBIAN-CVE-2014-9018
Updated: 2026-11-02

OSVMGASA-2014-0494 No score

Updated icecast package fixes security vulnerability

Icecast did not properly handle the launching of "scripts" on connect or disconnect of sources. This could result in sensitive information from these scripts leaking to (external) clients. (CVE-2014-9018)

Record: MGASA-2014-0494
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10067-1 No score

icecast-2.4.2-1.7 on GA media

These are all security issues fixed in the icecast-2.4.2-1.7 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10067-1
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-9018 No score

Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors.

Record: UBUNTU-CVE-2014-9018
Updated: 2026-11-02

Affected products

icecast

Affected packages

Affected packages
Package	Affected	Fixed
`icecast2` Debian:12	before 2.4.0-1.1	2.4.0-1.1
`icecast2` Debian:13	before 2.4.0-1.1	2.4.0-1.1
`icecast` Mageia:3	before 2.3.2-7.1.mga3	2.3.2-7.1.mga3
`icecast` Mageia:4	before 2.3.2-8.1.mga4	2.3.2-8.1.mga4
`icecast2` Ubuntu:14.04:LTS	before 2.3.3-2ubuntu1.14.04.1, plus listed versions 2.3.3-1ubuntu12.3.3-2ubuntu1	2.3.3-2ubuntu1.14.04.1
`icecast` openSUSE:Tumbleweed	before 2.4.2-1.7	2.4.2-1.7

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-9018 is a medium vulnerability (CVSS 5.0) in Icecast, published November 26, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.96%, the 87th percentile. Fixed in icecast2 2.4.0-1.1.

References

Show 13 moreShow less