Summary
Tobias Stoeckmann discovered that Fontconfig incorrectly handled cache
files. A local attacker could possibly use this issue with a specially
crafted cache file to elevate privileges.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | fontconfig | 2.11.0-0ubuntu4.2 |
| Ubuntu · 16.04 LTS 16.04:LTS | fontconfig | 2.11.94-0ubuntu1.1 |
Vulnerabilities 1
-
Unscored —
fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and conseq…
References
-
report
https://ubuntu.com/security/CVE-2016-5384