https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2018-18820.htmlhttps://patchthecve.com/cve/CVE-2018-18820.htmlWed, 17 Jun 2026 01:47:58 +0000HIGH 8.1: A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4. If the backend is enabled, then any malicious HTTP client can send a request for that specific resource including a crafted header, leading to denial of service and potentially remote code execution.https://patchthecve.com/cve/CVE-2015-3026.htmlhttps://patchthecve.com/cve/CVE-2015-3026.htmlWed, 17 Jun 2026 00:25:09 +0000MEDIUM 5.0: Icecast before 2.4.2, when a stream_auth handler is defined for URL authentication, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request without login credentials, as demonstrated by a request to "admin/killsource?mount=/test.ogg."https://patchthecve.com/cve/CVE-2014-9091.htmlhttps://patchthecve.com/cve/CVE-2014-9091.htmlWed, 17 Jun 2026 00:17:44 +0000MEDIUM 4.6: Icecast before 2.4.0 does not change the supplementary group privileges when <changeowner> is configured, which allows local users to gain privileges via unspecified vectors.https://patchthecve.com/cve/CVE-2014-9018.htmlhttps://patchthecve.com/cve/CVE-2014-9018.htmlWed, 17 Jun 2026 00:17:39 +0000MEDIUM 5.0: Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors.https://patchthecve.com/cve/CVE-2011-4612.htmlhttps://patchthecve.com/cve/CVE-2011-4612.htmlTue, 16 Jun 2026 23:35:08 +0000MEDIUM 5.0: icecast before 2.3.3 allows remote attackers to inject control characters such as newlines into the error loc (error.log) via a crafted URL.