CVE-2014-9091

Severity: medium (CVSS 4.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-12-10 · updated 2026-06-17
Weakness: CWE-264

Description

Icecast before 2.4.0 does not change the supplementary group privileges when <changeowner> is configured, which allows local users to gain privileges via unspecified vectors.

Affected products

Icecast: through 2.3.3

References

http://icecast.org/news/icecast-release-2_4_0/
http://lists.opensuse.org/opensuse-updates/2014-12/msg00037.html
http://seclists.org/oss-sec/2014/q4/794
http://seclists.org/oss-sec/2014/q4/802
https://bugzilla.redhat.com/show_bug.cgi?id=1168146
https://trac.xiph.org/changeset/19137/
http://icecast.org/news/icecast-release-2_4_0/
http://lists.opensuse.org/opensuse-updates/2014-12/msg00037.html
http://seclists.org/oss-sec/2014/q4/794
http://seclists.org/oss-sec/2014/q4/802
https://bugzilla.redhat.com/show_bug.cgi?id=1168146
https://trac.xiph.org/changeset/19137/

Get alerted when CVE-2014-9091 or the next vulnerability affects your stack