Description
libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
libical libical
Default version status: unaffected
0 to ≤ 4.0.6affected
pkg:github/libical/libicalReferences
- https://hackmd.io/@haind-pwn/libical-icalvalue-decode-ical-string-oob-read ↗
- https://github.com/libical/libical/pull/1455 ↗
- https://github.com/libical/libical/commit/d753885ce2de7c105d6b8c405aa7aee1d98ad8de ↗
- https://github.com/libical/libical/blob/9cfca65c122fa23b9680a28e0c9225a2fd015fc5/src/libical/icalvalue.c#L1608-L1645 ↗
- https://github.com/libical/libical ↗
- https://www.vulncheck.com/advisories/libical-through-4.0.6-heap-out-of-bounds-read-via-icalvalue-decode-ical-string ↗