Use-after-free in libical - CVE-2016-5824

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU17266

Use-after-free in libical - CVE-2016-5824

Published: January 30, 2019


Vulnerability identifier: #VU17266
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-5824
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform denial of service attack.

The vulnerability exists due to a use-after-free error when processing ics Calendar files. A remote attackers can trick the victim to open a specially crafted calendar file, trigger user-after-free error and crash the affected application.


Affected software

libical
SUSE Package Hub for SUSE Linux Enterprise
Gentoo Linux
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power
Opensuse
thunderbird (Ubuntu package)
Mozilla Thunderbird

How to mitigate CVE-2016-5824

Install update from vendor's website.

thunderbird (Ubuntu package) - addressed in versions 1:60.5.1+build2-0ubuntu0.14.04.1, 1:60.5.1+build2-0ubuntu0.16.04.1, 1:60.5.1+build2-0ubuntu0.18.04.1, 1:60.5.1+build2-0ubuntu0.18.10.1
Mozilla Thunderbird - update to 60.5

External References

Related Security Bulletins