The icaltime_from_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted string to the icalparser_parse_string function.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Huawei Euleros 2_0_sp2 | — | Upgrade libical-develUpgrade libical | Dec 4, 2019 | Jan 27, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libicalUpgrade libical-devel | Dec 18, 2019 | Jan 27, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 24, 2016 |
| Suse | — | Upgrade libical3Upgrade libical2Upgrade typelib-1_0-ICal-3_0Upgrade libical0Upgrade libical-glib3Upgrade libical-glib-develUpgrade libical1Upgrade libical0-32bitUpgrade libical1-32bitUpgrade libical-devel-staticUpgrade typelib-1_0-ICalGLib-3_0Upgrade libical-devel | Jul 28, 2017 | Jan 27, 2017 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jan 27, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub