CVE-2014-9018
Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote...
CVE-2014-9018 is a medium vulnerability (CVSS 5.0) in Icecast, published November 26, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.96%, the 87th percentile. Fixed in icecast2 2.4.0-1.1.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 2.96%EPSS, 87th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.4.0-1.1icecast2 +5 more
Description
Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
icecast2Debian:12 | before 2.4.0-1.1 | 2.4.0-1.1 |
icecast2Debian:13 | before 2.4.0-1.1 | 2.4.0-1.1 |
icecastMageia:3 | before 2.3.2-7.1.mga3 | 2.3.2-7.1.mga3 |
icecastMageia:4 | before 2.3.2-8.1.mga4 | 2.3.2-8.1.mga4 |
icecast2Ubuntu:14.04:LTS | before 2.3.3-2ubuntu1.14.04.1, plus listed versions 2.3.3-1ubuntu12.3.3-2ubuntu1 | 2.3.3-2ubuntu1.14.04.1 |
icecastopenSUSE:Tumbleweed From an advisory covering 2 CVEs | before 2.4.2-1.7 | 2.4.2-1.7 |
What each source reports
NVD Score used
Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors.
- Record
CVE-2014-9018- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE ListNo score
Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors.
- Record
CVE-2014-9018- Updated
- 2026-11-02
EUVDEUVD-2014-8846No score
Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors.
- Record
EUVD-2014-8846- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6r4c-pqmw-f493No score
Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote...
Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors.
- Record
GHSA-6r4c-pqmw-f493- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVNo score
Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors.
- Record
CVE-2014-9018- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-9018No score
Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors.
- Record
DEBIAN-CVE-2014-9018- Updated
- 2026-11-02
OSVMGASA-2014-0494No score
Updated icecast package fixes security vulnerability
Icecast did not properly handle the launching of "scripts" on connect or disconnect of sources. This could result in sensitive information from these scripts leaking to (external) clients. (CVE-2014-9018)
- Record
MGASA-2014-0494- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10067-1No score
icecast-2.4.2-1.7 on GA media
These are all security issues fixed in the icecast-2.4.2-1.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10067-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-9018No score
Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors.
- Record
UBUNTU-CVE-2014-9018- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
openwall.com/lists/oss-security/2014/11/19/23
mandriva.com/security/advisories?name=MDVSA-2014:231
icecast.org/news/icecast-release-2_4_1
trac.xiph.org/ticket/2087
lists.opensuse.org/opensuse-updates/2014-12/msg00038.html
securityfocus.com/bid/71312
Show 13 moreShow less
exchange.xforce.ibmcloud.com/vulnerabilities/98991
nvd.nist.gov/vuln/detail/CVE-2014-9018
github.com/advisories/GHSA-6r4c-pqmw-f493
security-tracker.debian.org/tracker/CVE-2014-9018
advisories.mageia.org/MGASA-2014-0494.html
bugs.mageia.org/show_bug.cgi?id=14629
bugs.debian.org/cgi-bin/bugreport.cgi?bug=770222
ubuntu.com/security/CVE-2014-9018
cve.org/CVERecord?id=CVE-2014-9018
suse.com/security/cve/CVE-2011-4612