PT-2017-3928 · Mozilla+5 · Thunderbird+5

Brandonprry · Published 2014-12-26 · Updated 2024-06-15 · CVE-2016-5824

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions libical version 1.0 Thunderbird (affected versions not specified)

Description The issue allows remote attackers to cause a denial of service. It is related to a use-after-free error, which can be triggered by a crafted ics file. The vulnerability is also associated with a memory usage issue after release, potentially enabling a remote attacker to cause a service disruption.

Recommendations For libical version 1.0, update to a version that fixes the use-after-free error. For Thunderbird, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2014-2495

ALT-PU-2019-1171

BDU:2020-00726

CESA-2019_0269

CESA-2019_0270

CVE-2016-5824

DLA-959-1

MGASA-2018-0021

OPENSUSE-SU-2019:0249-1

OPENSUSE-SU-2019:0251-1

OPENSUSE-SU-2019_0182-1

OPENSUSE-SU-2019_0251-1

OPENSUSE-SU-2024:10601-1

RHSA-2019:0269

RHSA-2019:0270

RHSA-2019_0269

RHSA-2019_0270

SUSE-SU-2017:1989-1

SUSE-SU-2017_1989-1

SUSE-SU-2018:0119-1

SUSE-SU-2019:0338-1

USN-3897-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Thunderbird

Ubuntu

References · 457

• 🔥 https://github.com/sophoslabs/CVE-2018-18500 · Exploit
• https://github.com/libical/libical/issues/286 · Patch
• https://github.com/libical/libical/issues/251 · Patch
• https://github.com/libical/libical/issues/235 · Patch
• https://usn.ubuntu.com/3897-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0021.html · Security Note
• https://linux.oracle.com/errata/ELSA-2019-0269.html · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2019-03/#CVE-2016-5824 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-5824 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-5824 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3897-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-18356 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-5824 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-5824 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-18500 · Vendor Advisory