Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Buffer Overflow via PICT 4-bit Pixel Unpacking

Summary

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution.

Remediation

1. Inventory every Scribus Scribus deployment, including staging.
2. Upgrade Scribus Scribus to the fixed version for your release line, listed under Affected versions.
3. Confirm the running version after the upgrade.

References

• Patchhttps://github.com/scribusproject/scribus/commit/d667b3b1d38e1808721315dc976d67b72070f6b4
• Patchhttps://github.com/scribusproject/scribus/commit/544a179241362eb254cb69a5cc68ef24388b265f
• Advisoryhttps://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-buffer-overflow-via-pict-4-bit-pixel-unpacking
• Referencehttps://github.com/scribusproject/scribus
• Referencehttps://wiki.scribus.net/canvas/1.6.7_Release