Is CVE-2016-5823 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-5823 being exploited in the wild.

How severe is CVE-2016-5823?

Medium severity, with a CVSS score of 5.5, published 27 January 2017.

Which products and versions are affected?

Libical Project Libical 0.47, 1.0, and all versions prior to 3.0.0.

Is there a fix for CVE-2016-5823?

A patch was published on 2019-04-02: Gentoo security advisory indicates version 3.0.0 as unaffected Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-5823 attacked?

It is attacked with local access or over the network, in a software library.

Am I affected by CVE-2016-5823?

Check whether you run Libical Project Libical at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-5823: libical use-after-free in icalproperty_new_clone

CVE-2016-5823 · Severity: medium · CVSS 5.5 · Published 2017-01-27

libical is a widely used software library for handling calendar data (iCalendar). A vulnerability in how it processes calendar files could allow an attacker to crash applications that use this library, such as email clients or scheduling software, by sending a specially crafted calendar (.ics) file. This results in a denial of service, potentially disrupting user schedules and communication tools.

Technologies: Libical Project Libical. Vendors: Libical Project.

Quick answers

Is CVE-2016-5823 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-5823 being exploited in the wild.
How severe is CVE-2016-5823?: Medium severity, with a CVSS score of 5.5, published 27 January 2017.
Which products and versions are affected?: Libical Project Libical 0.47, 1.0, and all versions prior to 3.0.0.
Is there a fix for CVE-2016-5823?: A patch was published on 2019-04-02: Gentoo security advisory indicates version 3.0.0 as unaffected Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-5823 attacked?: It is attacked with local access or over the network, in a software library.
Am I affected by CVE-2016-5823?: Check whether you run Libical Project Libical at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free vulnerability exists in the icalproperty_new_clone function within libical versions 0.47, 1.0, and potentially others prior to 3.0.0. The flaw is triggered when the library processes a malformed iCalendar (.ics) file, leading to a segmentation fault (SEGV) or memory corruption. While the NVD classifies the attack vector as local with user interaction (opening a file), the practical application in mail clients or servers often makes this reachable via remote delivery of malicious attachments. An attacker can exploit this to cause a denial of service (application crash). The issue was addressed in libical version 3.0.0.

Affected products

libical project libical 0.47, 1.0, and all versions prior to 3.0.0

Timeline

2016-06-25: disclosed: Public disclosure on oss-security mailing list
2017-01-27: advisory: NVD publication date
2019-04-02: patched: Gentoo security advisory indicates version 3.0.0 as unaffected

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.