Recommended update for libical SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0119-1 Final 1 1 2018-01-17T10:52:10Z current 2018-01-17T10:52:10Z 2018-01-17T10:52:10Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Recommended update for libical This update for libical fixes the following issues: Security issues fixed: - CVE-2016-5823: The icalproperty_new_clone function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file. (bnc#986632) - CVE-2016-5824: libical 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file. (bsc#986639) - CVE-2016-5825: The icalparser_parse_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted ics file. (bsc#986642) - CVE-2016-5826: The parser_get_next_char function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) by crafting a string to the icalparser_parse_string function. (bsc#986658) - CVE-2016-5827: The icaltime_from_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted string to the icalparser_parse_string function. (bsc#986631) - CVE-2016-9584: libical allows remote attackers to cause a denial of service (use-after-free) and possibly read heap memory via a crafted ics file. (bnc#1015964) Bug fixes: - libical crashes while parsing timezones (bsc#1044995) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-libical-13417,slessp4-libical-13417 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180119-1/ Link for SUSE-SU-2018:0119-1 https://lists.suse.com/pipermail/sle-security-updates/2018-January/003605.html E-Mail link for SUSE-SU-2018:0119-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1015964 SUSE Bug 1015964 https://bugzilla.suse.com/1044995 SUSE Bug 1044995 https://bugzilla.suse.com/986631 SUSE Bug 986631 https://bugzilla.suse.com/986632 SUSE Bug 986632 https://bugzilla.suse.com/986639 SUSE Bug 986639 https://bugzilla.suse.com/986642 SUSE Bug 986642 https://bugzilla.suse.com/986658 SUSE Bug 986658 https://www.suse.com/security/cve/CVE-2016-5823/ SUSE CVE CVE-2016-5823 page https://www.suse.com/security/cve/CVE-2016-5824/ SUSE CVE CVE-2016-5824 page https://www.suse.com/security/cve/CVE-2016-5825/ SUSE CVE CVE-2016-5825 page https://www.suse.com/security/cve/CVE-2016-5826/ SUSE CVE CVE-2016-5826 page https://www.suse.com/security/cve/CVE-2016-5827/ SUSE CVE CVE-2016-5827 page https://www.suse.com/security/cve/CVE-2016-9584/ SUSE CVE CVE-2016-9584 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 libical-devel-0.43-1.10.6.1 libical0-32bit-0.43-1.10.6.1 libical0-0.43-1.10.6.1 libical0-0.43-1.10.6.1 as a component of SUSE Linux Enterprise Server 11 SP4 libical0-32bit-0.43-1.10.6.1 as a component of SUSE Linux Enterprise Server 11 SP4 libical0-0.43-1.10.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libical0-32bit-0.43-1.10.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libical-devel-0.43-1.10.6.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libical0-32bit-0.43-1.10.6.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 The icalproperty_new_clone function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file. CVE-2016-5823 SUSE Linux Enterprise Server 11 SP4:libical0-0.43-1.10.6.1 SUSE Linux Enterprise Server 11 SP4:libical0-32bit-0.43-1.10.6.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libical0-0.43-1.10.6.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libical0-32bit-0.43-1.10.6.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libical-devel-0.43-1.10.6.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libical0-32bit-0.43-1.10.6.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180119-1/ https://www.suse.com/security/cve/CVE-2016-5823.html CVE-2016-5823 https://bugzilla.suse.com/986632 SUSE Bug 986632 libical 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file. CVE-2016-5824 SUSE Linux Enterprise Server 11 SP4:libical0-0.43-1.10.6.1 SUSE Linux Enterprise Server 11 SP4:libical0-32bit-0.43-1.10.6.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libical0-0.43-1.10.6.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libical0-32bit-0.43-1.10.6.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libical-devel-0.43-1.10.6.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libical0-32bit-0.43-1.10.6.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180119-1/ https://www.suse.com/security/cve/CVE-2016-5824.html CVE-2016-5824 https://bugzilla.suse.com/1015964 SUSE Bug 1015964 https://bugzilla.suse.com/1122983 SUSE Bug 1122983 https://bugzilla.suse.com/986631 SUSE Bug 986631 https://bugzilla.suse.com/986639 SUSE Bug 986639 https://bugzilla.suse.com/986642 SUSE Bug 986642 https://bugzilla.suse.com/986658 SUSE Bug 986658 The icalparser_parse_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted ics file. CVE-2016-5825 SUSE Linux Enterprise Server 11 SP4:libical0-0.43-1.10.6.1 SUSE Linux Enterprise Server 11 SP4:libical0-32bit-0.43-1.10.6.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libical0-0.43-1.10.6.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libical0-32bit-0.43-1.10.6.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libical-devel-0.43-1.10.6.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libical0-32bit-0.43-1.10.6.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180119-1/ https://www.suse.com/security/cve/CVE-2016-5825.html CVE-2016-5825 https://bugzilla.suse.com/986631 SUSE Bug 986631 https://bugzilla.suse.com/986639 SUSE Bug 986639 https://bugzilla.suse.com/986642 SUSE Bug 986642 https://bugzilla.suse.com/986658 SUSE Bug 986658 The parser_get_next_char function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) by crafting a string to the icalparser_parse_string function. CVE-2016-5826 SUSE Linux Enterprise Server 11 SP4:libical0-0.43-1.10.6.1 SUSE Linux Enterprise Server 11 SP4:libical0-32bit-0.43-1.10.6.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libical0-0.43-1.10.6.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libical0-32bit-0.43-1.10.6.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libical-devel-0.43-1.10.6.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libical0-32bit-0.43-1.10.6.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180119-1/ https://www.suse.com/security/cve/CVE-2016-5826.html CVE-2016-5826 https://bugzilla.suse.com/986631 SUSE Bug 986631 https://bugzilla.suse.com/986639 SUSE Bug 986639 https://bugzilla.suse.com/986642 SUSE Bug 986642 https://bugzilla.suse.com/986658 SUSE Bug 986658 The icaltime_from_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted string to the icalparser_parse_string function. CVE-2016-5827 SUSE Linux Enterprise Server 11 SP4:libical0-0.43-1.10.6.1 SUSE Linux Enterprise Server 11 SP4:libical0-32bit-0.43-1.10.6.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libical0-0.43-1.10.6.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libical0-32bit-0.43-1.10.6.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libical-devel-0.43-1.10.6.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libical0-32bit-0.43-1.10.6.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180119-1/ https://www.suse.com/security/cve/CVE-2016-5827.html CVE-2016-5827 https://bugzilla.suse.com/986631 SUSE Bug 986631 https://bugzilla.suse.com/986639 SUSE Bug 986639 https://bugzilla.suse.com/986642 SUSE Bug 986642 https://bugzilla.suse.com/986658 SUSE Bug 986658 libical allows remote attackers to cause a denial of service (use-after-free) and possibly read heap memory via a crafted ics file. CVE-2016-9584 SUSE Linux Enterprise Server 11 SP4:libical0-0.43-1.10.6.1 SUSE Linux Enterprise Server 11 SP4:libical0-32bit-0.43-1.10.6.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libical0-0.43-1.10.6.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libical0-32bit-0.43-1.10.6.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libical-devel-0.43-1.10.6.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libical0-32bit-0.43-1.10.6.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180119-1/ https://www.suse.com/security/cve/CVE-2016-9584.html CVE-2016-9584 https://bugzilla.suse.com/1015964 SUSE Bug 1015964