Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds memory access in the importsvm plugin, which does not verify that bitmap and transparency mask dimensions match. An attacker can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code execution with the rights of the user. Exploitation requires that a user opens or imports the malicious file.
Scribus · Scribus
Scribus versions before 1.6.7 and 1.7.x before 1.7.4 contain a heap buffer overflow in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. An attacker can supply a crafted PICT file with inconsistent width and row data that writes out of bounds when the file is placed or imported, causing crashes or possibly code execution. Exploitation requires a user to open or import the malicious file.
Scribus · Scribus
Scribus versions before 1.6.7 and 1.7.x before 1.7.4 contain a heap out-of-bounds write in the DRW import plugin for Micrografx Draw files. The plugin uses an unvalidated y offset to select image scanlines. A crafted DRW file that a user imports can write decoded bitmap data outside the heap buffer, which can crash Scribus or lead to code execution.
Scribus · Scribus
Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow in the TIFF image loader. A tiled TIFF file with crafted tile width, height and sample values can cause a heap overflow. An attacker who gets a user to open or import such a file can crash Scribus or possibly execute code in the user's session.
Scribus · Scribus
Scribus versions before 1.6.7 and 1.7.x before 1.7.4 contain a heap buffer overflow in the PICT image loader and import plugin. An attacker can craft a PICT file whose bytesPerLine value exceeds the image scanline size, which corrupts heap memory. If a user places or imports such a file, Scribus may crash or execute code with the user's privileges.
Scribus · Scribus
Scribus versions before 1.6.7 (and 1.7.x before 1.7.4) contain a heap out-of-bounds write in the PSD image loader, which uses unchecked values from the PSD file as array indexes. An attacker who convinces a user to place or import a crafted PSD file can corrupt heap memory, causing a crash and potentially code execution with the user's rights. No network service is involved, but user interaction is required.
Scribus · Scribus
