This update for libical fixes the following issues:
Security issues fixed:
CVE-2016-5823: The icalpropertynewclone function in libical 0.47 and 1.0 allows remote
attackers to cause a denial of service (use-after-free) via a crafted ics file. (bnc#986632)
CVE-2016-5824: libical 1.0 allows remote attackers to cause a denial of service (use-after-free)
via a crafted ics file. (bsc#986639)
CVE-2016-5825: The icalparserparsestring function in libical 0.47 and 1.0 allows remote
attackers to cause a denial of service (out-of-bounds heap read) via a crafted ics file.
(bsc#986642)
CVE-2016-5826: The parsergetnextchar function in libical 0.47 and 1.0 allows remote attackers
to cause a denial of service (out-of-bounds heap read) by crafting a string to the
icalparserparse_string function. (bsc#986658)
CVE-2016-5827: The icaltimefromstring function in libical 0.47 and 1.0 allows remote attackers
to cause a denial of service (out-of-bounds heap read) via a crafted string to the
icalparserparsestring function. (bsc#986631)
CVE-2016-9584: libical allows remote attackers to cause a denial of service (use-after-free) and
possibly read heap memory via a crafted ics file. (bnc#1015964)
Bug fixes:
libical crashes while parsing timezones (bsc#1044995)