Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Apple iCal may crash or run code from malicious calendar

CVE-2008-2006 · published 18 years ago
Summary

Apple iCal 3.0.1 on macOS can be forced to stop working or potentially run unwanted code when it opens a specially crafted calendar (.ics) file. An attacker who controls a CalDAV server or convinces a user to open such a file can cause the application to crash or execute code on the computer. Update iCal to the latest version and do not open calendar invitations from untrusted sources.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
apple ical 3.0.1
cpe:2.3:a:apple:ical:3.0.1:*:*:*:*:*:*:*
Original advisory text
Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers, and user-assisted remote attackers, to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbi...
Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers, and user-assisted remote attackers, to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via a .ics file containing (1) a large 16-bit integer on a TRIGGER line, or (2) a large integer in a COUNT field on an RRULE line.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Exploitation
10% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published22 May 2008
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2008-2006 · NVD
Track software like this
Free during beta