Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Buffer Overflow via PICT Pixmap Loader

Summary

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing or importing it crashes Scribus and may execute code as the user.

Remediation

1. Inventory every Scribus Scribus deployment, including staging.
2. Upgrade Scribus Scribus to the fixed version for your release line, listed under Affected versions.
3. Confirm the running version after the upgrade.

References

• Patchhttps://github.com/scribusproject/scribus/commit/d667b3b1d38e1808721315dc976d67b72070f6b4
• Patchhttps://github.com/scribusproject/scribus/commit/544a179241362eb254cb69a5cc68ef24388b265f
• Advisoryhttps://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-buffer-overflow-via-pict-pixmap-loader
• Referencehttps://github.com/scribusproject/scribus
• Referencehttps://wiki.scribus.net/canvas/1.6.7_Release