Scribus before 1.6.7 Heap Out-of-Bounds Write via PSD Image Loader

Summary

Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code execution as the user.

Remediation

1. Inventory every Scribus Scribus deployment, including staging.
2. Upgrade Scribus Scribus to the fixed version for your release line, listed under Affected versions.
3. Confirm the running version after the upgrade.

References

• Patchhttps://github.com/scribusproject/scribus/commit/cca3e4991dd199c103edb4a3bc5351f5cb88d62b
• Patchhttps://github.com/scribusproject/scribus/commit/d61e7ac5879a6d9dc23113eff2fe0007f398eadc
• Advisoryhttps://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-out-of-bounds-write-via-psd-image-loader
• Referencehttps://github.com/scribusproject/scribus
• Referencehttps://wiki.scribus.net/canvas/1.6.7_Release