CVE-2016-5384

7.8 HIGH

Published: August 13, 2016 Modified: May 06, 2026

Description

fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-2601.html

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2016/dsa-3644

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/92339

Source: secalert@redhat.com

Third Party Advisory VDB Entry

http://www.ubuntu.com/usn/USN-3063-1

Source: secalert@redhat.com

Third Party Advisory

https://cgit.freedesktop.org/fontconfig/commit/?id=7a4a5bd7897d216f0794ca9dbce0a4a5c9d14940

Source: secalert@redhat.com

Patch Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CJ45VRAMCIISHOVKFVOQYQUSTUJP7FC/

Source: secalert@redhat.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGOS4YYB7UYAWX5AEXJZHDIX4ZMSXSW5/

Source: secalert@redhat.com

https://lists.freedesktop.org/archives/fontconfig/2016-August/005792.html

Source: secalert@redhat.com

Mailing List Patch Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-2601.html