diff --git a/NEWS b/NEWS
index a2b9d7cf5..de0b4aa4c 100644
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,7 @@ Bug fixes
  - [web] fixed display of ghosts when dragging events
  - [web] fixed management of mail labels in Preferences module
  - [web] respect super user privileges to create in any calendar and addressbook
+ - [web] properly null-terminate IS8601-formatted dates (#3539) 
 
 3.0.2 (2016-03-04)
 ------------------
diff --git a/SoObjects/SOGo/NSCalendarDate+SOGo.m b/SoObjects/SOGo/NSCalendarDate+SOGo.m
index 5a48d681d..dc9ba8b4c 100644
--- a/SoObjects/SOGo/NSCalendarDate+SOGo.m
+++ b/SoObjects/SOGo/NSCalendarDate+SOGo.m
@@ -116,31 +116,32 @@ static NSString *rfc822Months[] = {@"", @"Jan", @"Feb", @"Mar", @"Apr",
 
 - (NSString *) iso8601DateString
 {
-  char buf[22];
-  int timeZoneHourShift, timeZoneMinuteShift, tzSeconds;
   NSNumber *day, *month, *year, *hour, *minute;
+  int timeZoneHourShift, timeZoneMinuteShift, tzSeconds;
+  char buf[23];
 
   day = [NSNumber numberWithInt: [self dayOfMonth]];
   month = [NSNumber numberWithInt: [self monthOfYear]];
   year = [NSNumber numberWithInt: [self yearOfCommonEra]];
   hour = [NSNumber numberWithInt: [self hourOfDay]];
   minute = [NSNumber numberWithInt: [self minuteOfHour]];
+  memset(buf, 0, 23);
 
   tzSeconds = [[self timeZone] secondsFromGMT];
   timeZoneHourShift = (tzSeconds / 3600);
   tzSeconds -= timeZoneHourShift * 3600;
   timeZoneMinuteShift = tzSeconds / 60;
 
-  sprintf(buf, "%04d-%02d-%02dT%02d:%02d%+.2d:%02d",
-          [year intValue],
-          [month intValue],
-          [day intValue],
-          [hour intValue],
-          [minute intValue],
-          timeZoneHourShift,
-          timeZoneMinuteShift);
+  snprintf(buf, 23, "%04d-%02d-%02dT%02d:%02d%+.2d:%02d",
+           [year intValue],
+           [month intValue],
+           [day intValue],
+           [hour intValue],
+           [minute intValue],
+           timeZoneHourShift,
+           timeZoneMinuteShift);
 
-  return [NSString stringWithCString:buf];
+  return [NSString stringWithCString: buf];
 }
 
 #define secondsOfDistantFuture 1073741823.0