View at Official suse advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2016-5384 severity low: SUSE including 16 source package names (fontconfig, fontconfig-2.10.95-10.el7, …), 76 product×package rows across 39 product lines (HPE Helion OpenStack 8, SUSE Liberty Linux 7, … (39 product lines)): Fixed 43, Known Not Affected 33.
fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.