CVE-2016-5384

What it actually does

The vulnerability allows local users to trigger arbitrary free calls leading to double-free attacks and arbitrary code execution by providing a crafted fontconfig cache file due to lack of offset validation.

Why it matters to the business

Attackers with local access could execute arbitrary code on affected systems, potentially leading to full system compromise and data breaches.

How an attack unfolds

An attacker with local access crafts a malicious fontconfig cache file with invalid offsets and places it in a location where fontconfig will load it, causing the library to perform invalid memory operations resulting in code execution.

How to fix it

Upgrade fontconfig to 2.12.1 or later; for horde/horde apply the fix from commit 2ec0d26edf4964d45739ce6414ca853446a216ba.

How to confirm the fix worked

Confirm fontconfig version is 2.12.1 or newer and verify the horde codebase contains commit 2ec0d26edf4964d45739ce6414ca853446a216ba.

Typical attack path

1. Obtain local user access on the target system
2. Craft a malicious cache file that exploits unvalidated offsets
3. Position the file for loading by fontconfig
4. Trigger cache processing to induce double-free and gain code execution

How to detect it

Examine system logs for fontconfig cache parsing errors or crashes, and inspect for unexpected processes or memory anomalies following cache loads.

What your security team should do

• Apply the fontconfig or horde fix immediately due to local code execution risk
• Restrict local user access to cache file locations
• Review systems for any custom fontconfig configurations that may increase exposure