CVE catalog

CVE-2018-18820

icecast2: CVE-2018-18820

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
48.94% · Oct 25, 2026

A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4. If the backend is enabled, then any malicious HTTP client can send a request for that specific resource including a crafted header, leading to denial of service and potentially remote code execution.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianicecast2sid2.5.0-2fixed
Debianicecast2trixie2.4.4-4fixed
Debianicecast2bookworm2.4.4-4fixed
Alpineicecast3.102.4.4-r0fixed
Alpineicecast3.112.4.4-r0fixed
Alpineicecast3.122.4.4-r0fixed
Alpineicecast3.132.4.4-r0fixed
Alpineicecast3.142.4.4-r0fixed
Alpineicecast3.152.4.4-r0fixed
Alpineicecast3.162.4.4-r0fixed
Alpineicecast3.172.4.4-r0fixed
Alpineicecast3.182.4.4-r0fixed
Alpineicecast3.192.4.4-r0fixed
Alpineicecast3.22.4.4-r0fixed
Alpineicecast3.202.4.4-r0fixed
Alpineicecast3.212.4.4-r0fixed
Alpineicecast3.222.4.4-r0fixed
Alpineicecast3.232.4.4-r0fixed
Alpineicecast3.242.4.4-r0fixed
Alpineicecast3.32.4.4-r0fixed
Alpineicecast3.42.4.4-r0fixed
Alpineicecast3.52.4.4-r0fixed
Alpineicecast3.62.4.4-r0fixed
Alpineicecast3.72.4.4-r0fixed
Alpineicecast3.82.4.4-r0fixed
Alpineicecast3.92.4.4-r0fixed
Ubuntuicecast216.042.4.2-1vulnerable
Ubuntuicecast216.042.4.2-1ubuntu0.1fixed
Ubuntuicecast218.042.4.3-2vulnerable
Ubuntuicecast218.042.4.3-2ubuntu0.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianicecast2sourcesid2.4.4-1not yet assignedNot reported[912611]
Debianicecast2sourcetrixie2.4.4-1not yet assignedNot reported[912611]
Debianicecast2sourcebookworm2.4.4-1not yet assignedNot reported[912611]
Alpineicecastapk3.102.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Alpineicecastapk3.112.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Alpineicecastapk3.122.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Alpineicecastapk3.132.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Alpineicecastapk3.142.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Alpineicecastapk3.152.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Alpineicecastapk3.162.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Alpineicecastapk3.172.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Alpineicecastapk3.182.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Alpineicecastapk3.192.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Alpineicecastapk3.22.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Alpineicecastapk3.202.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Alpineicecastapk3.212.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Alpineicecastapk3.222.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Alpineicecastapk3.232.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Alpineicecastapk3.242.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Alpineicecastapk3.32.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Alpineicecastapk3.42.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Alpineicecastapk3.52.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Alpineicecastapk3.62.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Alpineicecastapk3.72.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Alpineicecastapk3.82.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Alpineicecastapk3.92.4.4-r0Not reportedALPINE-CVE-2018-18820Not reported
Ubuntuicecast2deb16.042.4.2-1ubuntu0.1Not reportedUBUNTU-CVE-2018-18820Not reported
Ubuntuicecast2deb18.042.4.3-2ubuntu0.1Not reportedUBUNTU-CVE-2018-18820Not reported

[Debian bug #912611]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [icecast2]Fixed

    Source package: [icecast2]

    Details (2)

    • 2.4.4-4+b1 · amd64 · bookworm

      Fixed · Fixed: 2.4.4-1

      dsa · icecast2 · debian · bookworm; dsa · icecast2 · debian · 12

    • 2.4.4-4+b1 · arm64 · bookworm

      Fixed · Fixed: 2.4.4-1

      dsa · icecast2 · debian · bookworm; dsa · icecast2 · debian · 12

[Debian 13 (Trixie)]

  • [icecast2]Fixed
    Details (4)

    • 2.4.4-4+b2 · amd64 · trixie

      Fixed · Fixed: 2.4.4-1

      dsa · icecast2 · debian · 13

    • 2.4.4-4+b3 · arm64 · trixie

      Fixed · Fixed: 2.4.4-1

      dsa · icecast2 · debian · 13

    • 2.5.0-1~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 2.4.4-1

      dsa · icecast2 · debian · 13

    • 2.5.0-1~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 2.4.4-1

      dsa · icecast2 · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]