Junglewise Threat Intelligence

CVE-2016-5824: libical use-after-free in iCalendar parsing

CVE-2016-5824 · Severity: medium · CVSS 5.5 · Published 2017-01-27

Technologies: Mozilla Thunderbird, Libical Project Libical. Vendors: Mozilla, Libical Project.

Executive brief

libical is a widely used library for handling calendar data (iCalendar files). A vulnerability in this library allows an attacker to crash applications that process calendar files, such as email clients or scheduling software, by providing a specially crafted file. This could lead to a denial of service, preventing users from accessing their emails or calendars.

Technical details

A use-after-free vulnerability exists in libical 1.0 during the parsing of iCalendar (.ics) files. The flaw is triggered when the library processes a specifically crafted file, leading to memory corruption. While primarily identified as a denial-of-service vector, some researchers noted the potential for out-of-bounds reads of heap memory. The vulnerability affects applications utilizing libical for calendar processing, most notably Mozilla Thunderbird. Patches were eventually integrated into upstream libical and downstream distributions like Red Hat and Ubuntu.

Affected products

  • libical project libical 1.0
  • Mozilla Thunderbird prior to 60.5.0

Timeline

  • 2016-06-25: disclosed: Initial public discussion on oss-security mailing list
  • 2017-01-27: advisory: NVD publication date
  • 2019-02-04: patched: Red Hat released security updates for Thunderbird addressing the issue

References

Related threats