The vcalendar plugin relies on libical, which is provided in-tree. However, this included version is outdated. I am not aware of any security related issues with libical at the moment, but using the upstream version of libical can prevent some security issues should they arise (users only have to update libical, not claws-mail). The attached patch removes the in-tree version of libical and fixes the build to use an external version of libical. This patch also bumps the minimum dependency of libical to version 2.0 and a few code lines were adjusted accordingly. The patch is only tested on Linux. I do not know if Windows or OS X build were broken.
So the patch is a bit too large to be attached here directly, so please see this paste: https://bpaste.net/raw/9a4c01fcd5ba
Created attachment 1713 [details] the patch the patch linked in comment 1, gzipped and attached
Created attachment 1714 [details] Original patch sans removal of the builtin libical For convenience. :) This (removal of our old, decrepit libical) is definitely something we want. Windows build can be tested, as for Mac version, that is out of our hands - its maintainer will have to take care of testing.
Changes related to this bug have been committed. Please check latest Git and update the bug accordingly. You can also get the patch from: http://git.claws-mail.org/ ++ ChangeLog 2017-01-27 16:57:03.545437245 +0100 http://git.claws-mail.org/?p=claws.git;a=commitdiff;h=d76642c6c7cb6dfb8c1d94308d725bcb6a9d18ae Merge: ff4298a 8925ab2 Author: Colin Leroy <colin@colino.net> Date: Fri Jan 27 16:57:02 2017 +0100 Merge branch 'master' of file:///home/git/claws http://git.claws-mail.org/?p=claws.git;a=commitdiff;h=8925ab226ba8bb18928d61393d45e7d97f32777b Author: Paul <paul@claws-mail.org> Date: Fri Jan 27 15:56:47 2017 +0000 vCalendar plugin: use external libical closes bug #3764 patch by flo.xfce@gmx-topmail.de
Thanks!