Libical
Monthly
Decoding crafted iCalendar text that ends in a trailing backslash drives a heap-based out-of-bounds read in libical 4.0.6 and earlier, allowing the attacker to crash the consuming application or expose a small amount of adjacent heap memory. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, meaning a victim must locally open or process the malicious calendar data (for example a crafted .ics file, meeting invite, or subscribed feed) and the dominant outcome is a crash / denial of service, with only limited confidentiality loss rather than code execution; the PR:N component indicates no attacker credentials are needed on the affected host. No public exploit identified at time of analysis, the flaw is not listed in CISA KEV, and an upstream fix exists via the referenced pull request and commit.
Parsing attacker-controlled iCalendar data containing a parameterized property in libical 4.0.6 can terminate the consuming process, because icalparameter_string_to_kind() passes an incompatibly-cast comparator to bsearch(); the same defect exists in the libicalvcard path via vcardparameter_string_to_kind(). No authentication is required (CVSS PR:N) and no user interaction is encoded (UI:N), but exploitation hinges on the target being built with Control Flow Integrity enforcement or a function-pointer-type sanitizer, since type-confusion callbacks usually execute without aborting on ordinary non-hardened distro builds, and in practice a library needs to be fed untrusted calendar content by an application that parses it automatically or on user action. Independent assessment scores this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (input data lists 6.2 at AV:L), EPSS is only 0.17% (5th percentile), and no public exploit code has been identified at time of analysis; the issue is best characterized as a low-priority, high-noise type-confusion defect rather than a broadly exploitable denial-of-service vector.
The icaltime_from_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted string to the icalparser_parse_string function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The parser_get_next_char function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) by crafting a string to the icalparser_parse_string function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The icalparser_parse_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted ics file. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
libical 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
The icalproperty_new_clone function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
libical allows remote attackers to cause a denial of service (use-after-free) and possibly read heap memory via a crafted ics file. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Decoding crafted iCalendar text that ends in a trailing backslash drives a heap-based out-of-bounds read in libical 4.0.6 and earlier, allowing the attacker to crash the consuming application or expose a small amount of adjacent heap memory. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, meaning a victim must locally open or process the malicious calendar data (for example a crafted .ics file, meeting invite, or subscribed feed) and the dominant outcome is a crash / denial of service, with only limited confidentiality loss rather than code execution; the PR:N component indicates no attacker credentials are needed on the affected host. No public exploit identified at time of analysis, the flaw is not listed in CISA KEV, and an upstream fix exists via the referenced pull request and commit.
Parsing attacker-controlled iCalendar data containing a parameterized property in libical 4.0.6 can terminate the consuming process, because icalparameter_string_to_kind() passes an incompatibly-cast comparator to bsearch(); the same defect exists in the libicalvcard path via vcardparameter_string_to_kind(). No authentication is required (CVSS PR:N) and no user interaction is encoded (UI:N), but exploitation hinges on the target being built with Control Flow Integrity enforcement or a function-pointer-type sanitizer, since type-confusion callbacks usually execute without aborting on ordinary non-hardened distro builds, and in practice a library needs to be fed untrusted calendar content by an application that parses it automatically or on user action. Independent assessment scores this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (input data lists 6.2 at AV:L), EPSS is only 0.17% (5th percentile), and no public exploit code has been identified at time of analysis; the issue is best characterized as a low-priority, high-noise type-confusion defect rather than a broadly exploitable denial-of-service vector.
The icaltime_from_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted string to the icalparser_parse_string function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The parser_get_next_char function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) by crafting a string to the icalparser_parse_string function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The icalparser_parse_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted ics file. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
libical 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
The icalproperty_new_clone function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
libical allows remote attackers to cause a denial of service (use-after-free) and possibly read heap memory via a crafted ics file. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.