It was reported that offsets contained in cache files aren't checked if they're in legal ranges or are pointers at all. The lack of validation allows an attacker to trigger arbitrary free() calls, which in turn allows double free attacks and therefore arbitrary code execution. When used with setuid binaries using crafted cachefiles, privilege escalation is possible.
Acknowledgments: Name: Tobias Stoeckmann
The fix has been pushed to the upstream git: https://lists.freedesktop.org/archives/fontconfig/2016-August/005792.html
Public via https://lists.freedesktop.org/archives/fontconfig/2016-August/005792.html
BTW no bugs for Fedora?
Created mingw-fontconfig tracking bugs for this issue: Affects: fedora-all [bug 1364440]
Created fontconfig tracking bugs for this issue: Affects: fedora-all [bug 1364439]
Created mingw-fontconfig tracking bugs for this issue: Affects: epel-7 [bug 1364442]
fontconfig-2.11.94-7.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
fontconfig-2.11.94-5.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Our CVSS scoring reflects the fact that RHEL 7 and RHEL 6 contains no setuid root binaries which are linked to fontconfig.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2016:2601 https://rhn.redhat.com/errata/RHSA-2016-2601.html
Great job, now fontconfig doesn't use cache at all, causing every process to regenerate cache when started, and completely freezing my system at boot because I've had 2000+ fonts installed.