CVE-2015-3026

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

4.34%

Published

Apr 29, 2015

Modified

May 6, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Icecast before 2.4.2, when a stream_auth handler is defined for URL authentication, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request without login credentials, as demonstrated by a request to "admin/killsource?mount=/test.ogg."

Affected Products (4)

xiph · icecastvulnerable

debian · debian_linuxvulnerable

opensuse · opensusevulnerable

References (20)

http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163859.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164061.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164074.html

http://lists.opensuse.org/opensuse-updates/2015-04/msg00030.html

Third Party Advisory

http://lists.xiph.org/pipermail/icecast-dev/2015-April/002460.html

Vendor Advisory