Scribus before 1.6.7 Out-of-Bounds Memory Access via SVM Import Plugin

Summary

Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code execution as the user.

Remediation

1. Inventory every Scribus Scribus deployment, including staging.
2. Upgrade Scribus Scribus to the fixed version for your release line, listed under Affected versions.
3. Confirm the running version after the upgrade.

References

• Patchhttps://github.com/scribusproject/scribus/commit/c6aed467680d04e8ae8e0588579b095acdae40ef
• Patchhttps://github.com/scribusproject/scribus/commit/5a8f67c4207d6f729f23e4370b5846dadc81e8b4
• Advisoryhttps://www.vulncheck.com/advisories/scribus-before-1.6.7-out-of-bounds-memory-access-via-svm-import-plugin
• Referencehttps://github.com/scribusproject/scribus
• Referencehttps://wiki.scribus.net/canvas/1.6.7_Release