CVE-2015-3026: Null Pointer Dereference
Published Apr 8, 2015
·Updated
Icecast before 2.4.2, when a streamauth handler is defined for URL authentication, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request without login credentials, as demonstrated by a request to "admin/killsource?mount=/test.ogg."
Affected Software
6 affected componentsFixes available
debian/icecast2<=2.3.3-1, <=2.4.0-1.1
2.4.2-12.4.0-1.1+deb8u1
debian/icecast2
2.4.4-4
xiph Icecast<=2.4.1
Debian Debian Linux=8.0
openSUSE openSUSE=13.1
openSUSE openSUSE=13.2
Event History
Apr 29, 2015
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Aug 6, 2024
Data Sourced
via Debian·05:39 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2015-3026?
CVE-2015-3026 has a severity rating that indicates a risk of denial of service due to NULL pointer dereference.
2
How do I fix CVE-2015-3026?
To fix CVE-2015-3026, upgrade Icecast to version 2.4.2 or later.
3
What versions of Icecast are affected by CVE-2015-3026?
Icecast versions prior to 2.4.2, including 2.4.0 and earlier, are affected by CVE-2015-3026.
4
Can CVE-2015-3026 be exploited remotely?
Yes, CVE-2015-3026 can be exploited remotely through a request without login credentials.
5
What type of attack does CVE-2015-3026 represent?
CVE-2015-3026 represents a denial of service attack that causes server crashes.