CVE-2016-5384

· HIGHModified

← All CVEs

CVSS v3.1

7.8

EPSS

0.40%

Published

Aug 12, 2016

Modified

May 6, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-415

Affected Products (7)

fedoraproject · fedoravulnerable

fontconfig_project · fontconfig (up to 2.12.1)vulnerable

debian · debian_linuxvulnerable

canonical · ubuntu_linuxvulnerable

References (16)

http://rhn.redhat.com/errata/RHSA-2016-2601.html

Third Party Advisory

http://www.debian.org/security/2016/dsa-3644

Third Party Advisory

http://www.securityfocus.com/bid/92339

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-3063-1

Third Party Advisory

https://cgit.freedesktop.org/fontconfig/commit/?id=7a4a5bd7897d216f0794ca9dbce0a4a5c9d14940

PatchThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CJ45VRAMCIISHOVKFVOQYQUSTUJP7FC/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGOS4YYB7UYAWX5AEXJZHDIX4ZMSXSW5/

https://lists.freedesktop.org/archives/fontconfig/2016-August/005792.html

Mailing ListPatchThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-2601.html

Third Party Advisory

http://www.debian.org/security/2016/dsa-3644

Third Party Advisory

http://www.securityfocus.com/bid/92339

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-3063-1

Third Party Advisory

https://cgit.freedesktop.org/fontconfig/commit/?id=7a4a5bd7897d216f0794ca9dbce0a4a5c9d14940

PatchThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CJ45VRAMCIISHOVKFVOQYQUSTUJP7FC/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGOS4YYB7UYAWX5AEXJZHDIX4ZMSXSW5/

https://lists.freedesktop.org/archives/fontconfig/2016-August/005792.html

Mailing ListPatchThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs