CVE-2016-5384

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 13-08-2016 03:59

Last modified: - 31-01-2022 06:37

Total changes: - 2

Description

fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Low

Attack complexity

Local

Attack vector

High

Availability

High

Confidentiality

High

Integrity

Low

Privileges required

Unchanged

Scope

None

User interaction

7.8

Base score

1.8

5.9

Exploitability score

Impact score

Verification logic

vendor=fedoraproject AND product=fedora AND version=23

vendor=fedoraproject AND product=fedora AND version=24

vendor=fontconfig_project AND product=fontconfig AND versionEndExcluding=2.12.1

vendor=Debian AND product=debian_linux AND version=8.0

vendor=canonical AND product=ubuntu_linux AND version=12.04 AND software_edition=-

vendor=canonical AND product=ubuntu_linux AND version=14.04 AND software_edition=esm

vendor=canonical AND product=ubuntu_linux AND version=16.04 AND software_edition=esm

Reference

[Fontconfig] 20160805 fontconfig: Branch 'master' - 3 commits-Mailing List, Patch, Third Party Advisory
FEDORA-2016-e23ab56ce3-Third Party Advisory
https://cgit.freedesktop.org/fontconfig/commit/?id=7a4a5bd7897d216f0794ca9dbce0a4a5c9d14940
DSA-3644-Third Party Advisory
USN-3063-1-Third Party Advisory
FEDORA-2016-6802f2e52a-Mailing List, Third Party Advisory
92339-Third Party Advisory, VDB Entry
RHSA-2016:2601-Third Party Advisory

Keywords

CVE-2016-5384

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2016-5384

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures