CVE-2016-5384

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-415

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2016-2601.htmlThird Party Advisory
http://www.debian.org/security/2016/dsa-3644Third Party Advisory
http://www.securityfocus.com/bid/92339Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-3063-1Third Party Advisory
https://cgit.freedesktop.org/fontconfig/commit/?id=7a4a5bd7897d216f0794ca9dbce0a4a5c9d14940Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CJ45VRAMCIISHOVKFVOQYQUSTUJP7FC/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGOS4YYB7UYAWX5AEXJZHDIX4ZMSXSW5/
https://lists.freedesktop.org/archives/fontconfig/2016-August/005792.htmlMailing List, Patch, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2601.htmlThird Party Advisory
http://www.debian.org/security/2016/dsa-3644Third Party Advisory
http://www.securityfocus.com/bid/92339Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-3063-1Third Party Advisory
https://cgit.freedesktop.org/fontconfig/commit/?id=7a4a5bd7897d216f0794ca9dbce0a4a5c9d14940Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CJ45VRAMCIISHOVKFVOQYQUSTUJP7FC/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGOS4YYB7UYAWX5AEXJZHDIX4ZMSXSW5/
https://lists.freedesktop.org/archives/fontconfig/2016-August/005792.htmlMailing List, Patch, Third Party Advisory

Timeline

Published: Aug 13, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-53858.1PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from t CVE-2016-53868.1The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protec CVE-2016-53878.1The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untru CVE-2016-53888.1Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does CVE-2016-53905.3Foreman before 1.11.4 and 1.12.x before 1.12.1 allow remote authenticated users with the view_hosts permission containing a filter to obtain CVE-2016-53917.5libreswan before 3.18 allows remote attackers to cause a denial of service (NULL pointer dereference and pluto daemon restart).CVE-2016-53926.5The API server in Kubernetes, as used in Red Hat OpenShift Enterprise 3.2, in a multi tenant environment allows remote authenticated users w CVE-2016-53938.8In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbit CVE-2016-53946.1In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictiv CVE-2016-53954.8Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remo CVE-2016-53967.5Apache Traffic Server 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack.CVE-2016-53978.8The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting t