Scribus before 1.6.7 Heap Out-of-Bounds Write via Micrografx Draw Import

Summary

Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing crashes or code execution.

Remediation

1. Inventory every Scribus Scribus deployment, including staging.
2. Upgrade Scribus Scribus to the fixed version for your release line, listed under Affected versions.
3. Confirm the running version after the upgrade.

References

• Patchhttps://github.com/scribusproject/scribus/commit/69f52b53c78542b0a5d377fa0b058fb2773799dc
• Patchhttps://github.com/scribusproject/scribus/commit/f69b7056eb1a5758a5ebcf218c77b6d84fca97e2
• Advisoryhttps://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-out-of-bounds-write-via-micrografx-draw-import
• Referencehttps://github.com/scribusproject/scribus
• Referencehttps://wiki.scribus.net/canvas/1.6.7_Release