fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution. This is in FcFontCapabilities in fcfreetype.c.
Weakness
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Fontconfig | Fontconfig_project | 2.17.0 (including) | 2.17.0 (including) |
| Red Hat Hardened Images | RedHat | fontconfig-main-2.17.1-0.1.hum1 | * |