CVE-2016-5384: Double Free
Published Aug 12, 2016
·Updated
fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.
Affected Software
7 affected components
Fedoraproject Fedora=23
Fedoraproject Fedora=24
Fontconfig Project Fontconfig<2.12.1
Debian Debian Linux=8.0
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Remediation
Event History
Aug 12, 2016
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-5384?
CVE-2016-5384 has a high severity rating as it can lead to arbitrary code execution due to double free vulnerabilities.
2
How do I fix CVE-2016-5384?
To fix CVE-2016-5384, update Fontconfig to version 2.12.1 or later.
3
Which operating systems are affected by CVE-2016-5384?
CVE-2016-5384 affects Fedora versions 23 and 24, Debian 8.0, and Ubuntu versions 12.04, 14.04, and 16.04.
4
What type of vulnerability is CVE-2016-5384?
CVE-2016-5384 is a memory corruption vulnerability that allows local users to execute arbitrary code.
5
Who can be affected by CVE-2016-5384?
Local users with access to create or modify Fontconfig cache files can be affected by CVE-2016-5384.