{"id":"CVE-2016-5384","aliases":["DEBIAN-CVE-2016-5384","DLA-587-1","DSA-3644-1","EUVD-2016-6334","GHSA-g839-937g-3fhv","MGASA-2016-0287","RHSA-2016:2601","SUSE-SU-2016:2186-1","SUSE-SU-2016:2190-1","UBUNTU-CVE-2016-5384","USN-3063-1"],"status":"published","title":"fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary...","description":"fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00403,"percentile":0.34828,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2016-08-08T00:00:00Z","modified":"2026-10-24T10:30:44Z","fixes":[{"ecosystem":"Debian:12","package":"fontconfig","fixed_in":["2.11.0-6.5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"fontconfig","fixed_in":["2.11.0-6.5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"fontconfig","fixed_in":["2.11.0-6.5"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"fontconfig","fixed_in":["2.9.0-7.1+deb7u1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"fontconfig","fixed_in":["2.11.0-6.3+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"fontconfig","fixed_in":["2.11.1-4.1.mga5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"fontconfig-debuginfo","fixed_in":["0:2.10.95-10.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"fontconfig-devel","fixed_in":["0:2.10.95-10.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"fontconfig-devel-doc","fixed_in":["0:2.10.95-10.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"fontconfig","fixed_in":["0:2.10.95-10.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fontconfig-debuginfo","fixed_in":["0:2.10.95-10.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fontconfig-devel","fixed_in":["0:2.10.95-10.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fontconfig-devel-doc","fixed_in":["0:2.10.95-10.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fontconfig","fixed_in":["0:2.10.95-10.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fontconfig-devel-doc","fixed_in":["0:2.10.95-10.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fontconfig","fixed_in":["0:2.10.95-10.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fontconfig-debuginfo","fixed_in":["0:2.10.95-10.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fontconfig-devel","fixed_in":["0:2.10.95-10.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fontconfig-devel-doc","fixed_in":["0:2.10.95-10.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fontconfig","fixed_in":["0:2.10.95-10.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fontconfig-debuginfo","fixed_in":["0:2.10.95-10.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fontconfig-devel","fixed_in":["0:2.10.95-10.el7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"fontconfig","fixed_in":["2.6.0-10.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"fontconfig","fixed_in":["2.6.0-10.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"fontconfig","fixed_in":["2.6.0-10.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"fontconfig","fixed_in":["2.11.0-6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"fontconfig","fixed_in":["2.11.0-6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"fontconfig","fixed_in":["2.11.0-6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"fontconfig","fixed_in":["2.11.0-6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"fontconfig","fixed_in":["2.11.0-0ubuntu4.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"fontconfig","fixed_in":["2.11.94-0ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"fontconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-6.5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"fontconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-6.5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"fontconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-6.5"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"fontconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-7.1+deb7u1"}]}],"versions":["2.9.0-7.1"]},{"source":"osv","ecosystem":"Debian:8","package":"fontconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-6.3+deb8u1"}]}],"versions":["2.11.0-6.3","2.11.0-6.3+deb8u1~kbsd8u1"]},{"source":"osv","ecosystem":"Mageia:5","package":"fontconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1-4.1.mga5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"fontconfig-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.95-10.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"fontconfig-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.95-10.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"fontconfig-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.95-10.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"fontconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.95-10.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fontconfig-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.95-10.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fontconfig-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.95-10.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fontconfig-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.95-10.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fontconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.95-10.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fontconfig-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.95-10.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fontconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.95-10.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fontconfig-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.95-10.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fontconfig-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.95-10.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fontconfig-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.95-10.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fontconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.95-10.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fontconfig-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.95-10.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fontconfig-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.95-10.el7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"fontconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-10.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"fontconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-10.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"fontconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-10.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"fontconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"fontconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"fontconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"fontconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"fontconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-0ubuntu4.2"}]}],"versions":["2.10.93-0ubuntu1","2.11.0-0ubuntu1","2.11.0-0ubuntu2","2.11.0-0ubuntu3","2.11.0-0ubuntu4","2.11.0-0ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"fontconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.94-0ubuntu1.1"}]}],"versions":["2.11.1-0ubuntu6","2.11.1-0ubuntu7","2.11.1-0ubuntu8","2.11.1-0ubuntu9","2.11.94-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"fontconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-0ubuntu4.2"}]}],"versions":["2.10.93-0ubuntu1","2.11.0-0ubuntu1","2.11.0-0ubuntu2","2.11.0-0ubuntu3","2.11.0-0ubuntu4","2.11.0-0ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"fontconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.94-0ubuntu1.1"}]}],"versions":["2.11.1-0ubuntu6","2.11.1-0ubuntu7","2.11.1-0ubuntu8","2.11.1-0ubuntu9","2.11.94-0ubuntu1"]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"fontconfig_project","product":"fontconfig"}],"references":[{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGOS4YYB7UYAWX5AEXJZHDIX4ZMSXSW5/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-3063-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.freedesktop.org/archives/fontconfig/2016-August/005792.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2601.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://cgit.freedesktop.org/fontconfig/commit/?id=7a4a5bd7897d216f0794ca9dbce0a4a5c9d14940","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://www.securityfocus.com/bid/92339","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3644","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CJ45VRAMCIISHOVKFVOQYQUSTUJP7FC/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5384","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2601","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5384","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1350891","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CJ45VRAMCIISHOVKFVOQYQUSTUJP7FC"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGOS4YYB7UYAWX5AEXJZHDIX4ZMSXSW5"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6CJ45VRAMCIISHOVKFVOQYQUSTUJP7FC"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GGOS4YYB7UYAWX5AEXJZHDIX4ZMSXSW5"},{"url":"https://github.com/advisories/GHSA-g839-937g-3fhv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-5384","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0287.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19157","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2016/msg00222.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1073460","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2601.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5384","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162186-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/992534","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5384","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162190-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-5384","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3063-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-5384","description":"fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.","status":"published","published":"2016-08-12T16:00:00Z","modified":"2024-08-06T01:00:59.957Z","updated_at":"2026-11-02T14:33:30.359814Z"}],"euvd":[{"id":"EUVD-2016-6334","description":"fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.","status":"published","published":"2016-08-12T16:00:00Z","modified":"2024-08-06T01:00:59Z","updated_at":"2026-11-03T02:22:42.442421Z"}],"ghsa":[{"id":"GHSA-g839-937g-3fhv","title":"fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary...","description":"fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.","status":"published","published":"2022-05-13T01:04:13Z","modified":"2025-04-12T13:03:31Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T15:01:28.663035Z"}],"nvd":[{"id":"CVE-2016-5384","description":"fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.","status":"published","published":"2016-08-13T01:59:05.273Z","modified":"2026-06-17T00:49:18.293Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:03:28.854267Z"}],"osv":[{"id":"CVE-2016-5384","description":"fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.","status":"published","published":"2016-08-13T01:59:05.273Z","modified":"2026-10-24T10:30:44.093748933Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"DEBIAN-CVE-2016-5384","description":"fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.","status":"published","published":"2016-08-13T01:59:05.273Z","modified":"2026-09-22T07:01:29.708061041Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"RHSA-2016:2601","title":"Red Hat Security Advisory: fontconfig security and bug fix update","status":"published","published":"2024-09-15T23:32:22Z","modified":"2026-06-26T12:21:52.765763813Z","cvss":[{"version":"3.0","score":4.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"UBUNTU-CVE-2016-5384","description":"fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.","status":"published","published":"2016-08-08T00:00:00Z","modified":"2026-04-22T10:52:20.409437Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.642042Z"},{"id":"DLA-587-1","title":"fontconfig - security update","status":"published","published":"2016-08-08T00:00:00Z","modified":"2026-03-09T02:11:18.043029Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3644-1","title":"fontconfig - security update","status":"published","published":"2016-08-08T00:00:00Z","modified":"2026-03-09T01:18:05.120842Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0287","title":"Updated fontconfig packages fix security vulnerability","description":"Tobias Stoeckmann discovered that cache files are insufficiently\nvalidated in fontconfig, a generic font configuration library. An\nattacker can trigger arbitrary free() calls, which in turn allows\ndouble free attacks and therefore arbitrary code execution. In\ncombination with setuid binaries using crafted cache files, this\ncould allow privilege escalation (CVE-2016-5384).\n","status":"published","published":"2016-08-31T15:32:33Z","modified":"2026-04-16T06:25:16.234051889Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"SUSE-SU-2016:2186-1","title":"Security update for fontconfig","description":"\nThis update for fontconfig fixes the following issues:\n\n- security update:\n  * CVE-2016-5384: Possible double free due to insufficiently validated cache files [bsc#992534]\n","status":"published","published":"2016-08-30T07:31:20Z","modified":"2026-02-04T04:09:27.91375Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2190-1","title":"Security update for fontconfig","description":"\nThis update for fontconfig fixes the following issues:\n\n- security update:\n  * CVE-2016-5384: Possible double free due to insufficiently validated cache files [bsc#992534]\n","status":"published","published":"2016-08-30T07:52:30Z","modified":"2026-02-04T02:46:44.290809Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-3063-1","title":"fontconfig vulnerability","description":"Tobias Stoeckmann discovered that Fontconfig incorrectly handled cache\nfiles. A local attacker could possibly use this issue with a specially\ncrafted cache file to elevate privileges.\n","status":"published","published":"2016-08-17T16:53:35Z","modified":"2026-04-22T09:26:16.859397Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}