Executive brief
A vulnerability in the libical library, which handles calendar data, could allow an attacker to crash applications that process calendar files. By sending a specially crafted calendar string, a remote attacker can trigger a memory error that causes the service or application to stop responding. This primarily impacts the availability of systems using this library, such as email clients or calendar servers.
Technical details
An out-of-bounds (OOB) heap read exists in the 'parser_get_next_char' function within libical versions 0.47 and 1.0. The vulnerability is triggered when the 'icalparser_parse_string' function processes a specially crafted iCalendar (.ics) string, leading to a memory access violation. An attacker can exploit this remotely without authentication by providing malicious calendar data to an application utilizing the library (such as Mozilla Thunderbird's Lightning component). While primarily resulting in a denial of service (crash), OOB reads can sometimes be leveraged to bypass memory mitigations. The issue was tracked by Mozilla as a low-severity risk for Thunderbird but remains a high-severity DoS for the underlying library.
Affected products
- libical project libical 0.47, 1.0
- Mozilla Thunderbird unspecified
Timeline
- 2016-06-25: disclosed: Public discussion on oss-security mailing list
- 2017-01-27: advisory: NVD publication date