Description
libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| libical | libical | ≤ 4.0.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libical3 | No fix yet | — |
| Debian 13 | libical3 | No fix yet | — |
| Debian 12 | libical3 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libical | No fix yet | — |
| Ubuntu 16.04 LTS | libical | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libical | 3.0.10-3 | — |
References
- https://hackmd.io/@haind-pwn/libical-icalvalue-decode-ical-string-oob-read technical-description
- https://github.com/libical/libical/pull/1455 patch issue-tracking
- https://github.com/libical/libical/commit/d753885ce2de7c105d6b8c405aa7aee1d98ad8de patch
- https://github.com/libical/libical/blob/9cfca65c122fa23b9680a28e0c9225a2fd015fc5/src/libical/icalvalue.c#L1608-L1645 technical-description
- https://github.com/libical/libical product
- VulnCheck Advisory: libical through 4.0.6 Heap Out-of-Bounds Read via icalvalue_decode_ical_string third-party-advisory