The icaltime_from_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted string to the icalparser_parse_string function.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Huawei Euleros 2_0_sp2 | — | Upgrade libicalUpgrade libical-devel | Dec 4, 2019 | Jan 27, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libical-develUpgrade libical | Dec 18, 2019 | Jan 27, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 24, 2016 |
| Suse | — | Upgrade libical3Upgrade libical0Upgrade typelib-1_0-ICal-3_0Upgrade libical0-32bitUpgrade libical2Upgrade libical-glib3Upgrade libical1Upgrade libical-glib-develUpgrade libical-develUpgrade typelib-1_0-ICalGLib-3_0Upgrade libical-devel-staticUpgrade libical1-32bit | Jul 28, 2017 | Jan 27, 2017 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jan 27, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub