CVE-2019-11703
libical: Heap buffer over read in icalparser.c parser_get_next_char
Severity
ModerateRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · June 13, 2019
Updated · November 22, 2025
Description
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
Thunderbird can be configured to use icaljs instead of libical by setting calendar.icaljs = true in preferences, mitigating this vulnerability.
CVSS / CWE
CVSS 3.0 · 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-122 · Heap-based Buffer Overflow