CVE-2016-5826

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The parser_get_next_char function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) by crafting a string to the icalparser_parse_string function.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2016/06/25/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/91459Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1281041Issue Tracking
http://www.openwall.com/lists/oss-security/2016/06/25/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/91459Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1281041Issue Tracking

Timeline

Published: Jan 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-58277.5The icaltime_from_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via CVE-2016-58287.8The start_thread function in arch/powerpc/kernel/process.c in the Linux kernel through 4.6.3 on powerpc platforms mishandles transactional s CVE-2016-58297.8Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 all CVE-2016-58327.5The customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection restrictions via unspecified vectors.CVE-2016-58336.1Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before CVE-2016-58346.1Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 a CVE-2016-58357.5WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, re CVE-2016-58367.5The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.CVE-2016-58377.5WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspec CVE-2016-58387.5WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.CVE-2016-58397.5WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors.CVE-2016-58407.2hotfix_upload.cgi in Trend Micro Deep Discovery Inspector (DDI) 3.7, 3.8 SP1 (3.81), and 3.8 SP2 (3.82) allows remote administrators to exec