Icecast before 2.4.0 does not change the supplementary group privileges when <changeowner> is configured, which allows local users to gain privileges via unspecified vectors.
{ "availability": "No subscription required", "binaries": [ { "binary_name": "icecast2", "binary_version": "2.3.3-2ubuntu1.14.04.1" } ] }