The icaltime_from_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted string to the icalparser_parse_string function.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Huawei Euleros 2_0_sp2 | — | Upgrade libicalUpgrade libical-devel | Dec 4, 2019 | Jan 27, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libicalUpgrade libical-devel | Dec 18, 2019 | Jan 27, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 24, 2016 |
| Suse | — | Upgrade libical2Upgrade libical0Upgrade libical0-32bitUpgrade libical3Upgrade libical-glib-develUpgrade typelib-1_0-ICal-3_0Upgrade libical-glib3Upgrade libical1Upgrade typelib-1_0-ICalGLib-3_0Upgrade libical-develUpgrade libical1-32bitUpgrade libical-devel-static | Jul 28, 2017 | Jan 27, 2017 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jan 27, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub