Summary: | <net-misc/icecast-2.4.1: possible leak of on-connect scripts (CVE-2014-9018) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | minor | CC: | polynomial-c |
Priority: | Normal | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | https://bugzilla.redhat.com/show_bug.cgi?id=1165880 | ||
Whiteboard: | B4 [glsa] | ||
Package list: | Runtime testing required: | --- |
Description
Agostino Sarubbo
2014-11-20 13:49:57 UTC
+*icecast-2.4.1 (20 Nov 2014) + + 20 Nov 2014; Lars Wendler <polynomial-c@gentoo.org> +icecast-2.4.1.ebuild, + files/icecast.xml: + Security bump (bug #529956) with kind permission by hwoarang. + Arches please test and mark stable =net-misc/icecast-2.4.1 with target KEYWORDS: amd64 ppc ppc64 x86 ~x86-fbsd amd64 stable x86 stable ppc64 stable ppc stable. Maintainer(s), please cleanup. Security, please vote. + 06 Dec 2014; Lars Wendler <polynomial-c@gentoo.org> -icecast-2.3.3-r2.ebuild, + -icecast-2.3.3-r3.ebuild, -icecast-2.4.0.ebuild, -files/init.d.icecast, + metadata.xml: + Removed vulnerable versions. Took over maintenance. + Arches and Mainter(s), Thank you for your work. Added to an existing GLSA request. CVE-2014-9018 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9018): Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors. This issue was resolved and addressed in GLSA 201412-38 at http://security.gentoo.org/glsa/glsa-201412-38.xml by GLSA coordinator Sean Amoss (ackle). |