Red Hat Security AdvisoryRHSA-2016:2601
fontconfig security and bug fix update
Released 2016-11-03 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) fontconfig-2.10.95-10.el7
- Red Hat Enterprise Linux Client Optional (v. 7) fontconfig-devel-2.10.95-10.el7, fontconfig-devel-doc-2.10.95-10.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) fontconfig-2.10.95-10.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) fontconfig-devel-2.10.95-10.el7, fontconfig-devel-doc-2.10.95-10.el7
- Red Hat Enterprise Linux Server (v. 7) fontconfig-2.10.95-10.el7, fontconfig-2.10.95-10.el7.ppc, fontconfig-devel-2.10.95-10.el7 +1
- Red Hat Enterprise Linux Server Optional (v. 7) fontconfig-devel-doc-2.10.95-10.el7
- Red Hat Enterprise Linux Workstation (v. 7) fontconfig-2.10.95-10.el7, fontconfig-devel-2.10.95-10.el7
- Red Hat Enterprise Linux Workstation Optional (v. 7) fontconfig-devel-doc-2.10.95-10.el7
Fixes 1 record
Priority LOW 34
fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00403 · Published 2016-08-12 · Partial fix CWE-415
