Scribus: Out-of-bounds read in Mac PICT image loader
Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read in the Mac PICT image loader and import plugin when decoding planar pixel data. An attacker can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads. This can crash Scribus or disclose heap memory contents. Exploitation requires a user to open or import the malicious file.
The Scribus Team · Scribus
