Is CVE-2016-5824 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-5824 being exploited in the wild.

How severe is CVE-2016-5824?

Medium severity, with a CVSS score of 5.5, published 27 January 2017.

Which products and versions are affected?

Libical Project Libical 1.0; Mozilla Thunderbird prior to 60.5.0.

Is there a fix for CVE-2016-5824?

A patch was published on 2019-02-04: Red Hat released security updates for Thunderbird addressing the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-5824 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2016-5824?

Check whether you run Libical Project Libical or Mozilla Thunderbird at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-5824: libical use-after-free in iCalendar parsing

CVE-2016-5824 · Severity: medium · CVSS 5.5 · Published 2017-01-27

libical is a widely used library for handling calendar data (iCalendar files). A vulnerability in this library allows an attacker to crash applications that process calendar files, such as email clients or scheduling software, by providing a specially crafted file. This could lead to a denial of service, preventing users from accessing their emails or calendars.

Technologies: Libical Project Libical, Mozilla Thunderbird. Vendors: Libical Project, Mozilla.

Quick answers

Is CVE-2016-5824 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-5824 being exploited in the wild.
How severe is CVE-2016-5824?: Medium severity, with a CVSS score of 5.5, published 27 January 2017.
Which products and versions are affected?: Libical Project Libical 1.0; Mozilla Thunderbird prior to 60.5.0.
Is there a fix for CVE-2016-5824?: A patch was published on 2019-02-04: Red Hat released security updates for Thunderbird addressing the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-5824 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2016-5824?: Check whether you run Libical Project Libical or Mozilla Thunderbird at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free vulnerability exists in libical 1.0 during the parsing of iCalendar (.ics) files. The flaw is triggered when the library processes a specifically crafted file, leading to memory corruption. While primarily identified as a denial-of-service vector, some researchers noted the potential for out-of-bounds reads of heap memory. The vulnerability affects applications utilizing libical for calendar processing, most notably Mozilla Thunderbird. Patches were eventually integrated into upstream libical and downstream distributions like Red Hat and Ubuntu.

Affected products

libical project libical 1.0
Mozilla Thunderbird prior to 60.5.0

Timeline

2016-06-25: disclosed: Initial public discussion on oss-security mailing list
2017-01-27: advisory: NVD publication date
2019-02-04: patched: Red Hat released security updates for Thunderbird addressing the issue

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.