peter bassill · operator
$ cve CVE-2008-1035 JSON

CVE-2008-1035 EXPLOIT

4.3
MEDIUM · CVSS 2.0 · EPSS 10.1% (pctl 95)

Patch early

A public exploit exists.

Description

Use-after-free vulnerability in Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers, and user-assisted remote attackers, to trigger memory corruption or possibly execute arbitrary code via an "ATTACH;VALUE=URI:S=osumi" line in a .ics file, which triggers a "resource liberation" bug. NOTE: CVE-2008-2007 was originally used for this issue, but this is the appropriate identifier.

Scoring

CVSS4.3 (MEDIUM, v2.0)
VectorAV:N/AC:M/Au:N/C:N/I:N/A:P
EPSS10.12% — more likely to be exploited than 95% of all CVEs
WeaknessCWE-94
On CISA KEVno
Public exploityes
Published2008-06-03
Last modified2026-06-16

Affected (1)

VendorProduct
appleical

Public exploits

SourceTitleDate
exploit-dbApple iCal 3.0.1 - 'ATTACH' Denial of Service2008-04-21

References

→ the Explorer  ·  watch your stack  ·  NVD