Updated fontconfig packages fix security vulnerability

🗓️ 31 Aug 2016 15:32:33Reported by Gentoo FoundationType

Updated fontconfig packages fix security vulnerability discovered by Tobias Stoeckmann. Cache files are insufficiently validated, allowing arbitrary code execution and privilege escalation

Reporter	Title	Published	Views	Family All 67
FreeBSD	fontconfig -- insufficiently cache file validation	5 Aug 201600:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM Flex System Manager (FSM) is affected by a vulnerability in fontconfig (CVE-2016-5384)	18 Jun 201801:34	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in fontconfig affects PowerKVM (CVE-2016-5384)	18 Jun 201801:34	–	ibm
Tenable Nessus	CentOS 7 : fontconfig (CESA-2016:2601)	28 Nov 201600:00	–	nessus
Tenable Nessus	Debian DLA-587-1 : fontconfig security update	10 Aug 201600:00	–	nessus
Tenable Nessus	Debian DSA-3644-1 : fontconfig - security update	9 Aug 201600:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP1 : fontconfig (EulerOS-SA-2016-1077)	1 May 201700:00	–	nessus
Tenable Nessus	Fedora 23 : fontconfig (2016-6802f2e52a)	18 Aug 201600:00	–	nessus
Tenable Nessus	Fedora 24 : fontconfig (2016-e23ab56ce3)	9 Aug 201600:00	–	nessus
Tenable Nessus	FreeBSD : fontconfig -- insufficiently cache file validation (44989c29-67d1-11e6-8b1d-c86000169601)	22 Aug 201600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Mageia	5	any	fontconfig	2.11.1-4.1	fontconfig-2.11.1-4.1.noarch.rpm

Source	Link
bugs	www.bugs.mageia.org/show_bug.cgi
lists	www.lists.debian.org/debian-security-announce/2016/msg00222.html

31 Aug 2016 15:32Current

3.3Low risk

Vulners AI Score3.3

CVSS 24.6

CVSS 3.17.8

EPSS0.00264