Scribus
Monthly
Out-of-bounds heap reads and writes in Scribus's SVM import plugin (importsvm) before 1.6.7 can crash the application or potentially enable code execution when a user opens a crafted StarView Metafile whose bitmap and transparency-mask dimensions disagree. The issue is local and requires user interaction to import the malicious file, and no public exploit was identified at time of analysis. It is a moderate-priority file-parsing memory-corruption issue rather than a mass-exploitation emergency, and the vendor has released Scribus 1.6.7 with fixes for the affected parsing path.
Heap buffer overflow in Scribus before 1.6.7, in both the Mac PICT image data loader and the pct import plugin, lets a crafted .pict/.pct file whose declared width is inconsistent with its actual row data write past the end of a heap buffer when the image is placed or imported, crashing Scribus or potentially achieving code execution. The attack is local and gated on user interaction: the victim must actively open, place, or import the malicious image (no privileges required, no network-facing or unattended vector), and no public exploit has been identified at time of analysis. Version 1.6.7 addresses the flaw by bounding copy lengths and nibble-expansion loops against the real scanline and source buffer sizes.
Heap-based out-of-bounds write in Scribus's Micrografx Draw (.DRW) import plugin (importdrw) before 1.6.7 allows local attackers to corrupt memory when a victim imports a crafted DRW file, resulting in a crash or potentially code execution. The plugin uses an unvalidated y offset to select image scanlines while decoding bitmap data, so writes can occur past the allocated heap image buffer; the attack is file-driven and requires user interaction to import the malicious document. No public exploit code or active exploitation has been identified at the time of analysis, and the vendor fix is Scribus 1.6.7.
Integer overflow in Scribus' TIFF tile loader (scimgdataloader_tiff) before 1.6.7 lets a crafted tiled TIFF corrupt heap memory when a user imports it into the application, crashing Scribus and potentially allowing code execution under the importing user's privileges. The flawed step is the 32-bit size calculation used to allocate the tile buffer (TILEWIDTH x TILELENGTH x sizeof(uint32_t)), so an attacker who supplies large tile width, height and sample values causes an undersized allocation that libtiff then fills with tile data. Triggering it is local and requires passive user interaction (CVSS:4.0 AV:L/PR:N/UI:P; assessed as CVSS:3.1 AV:L/AC:L/PR:N/UI:R), and while the heap corruption is confirmed by the upstream fix, reliable code execution depends on heap layout and is not demonstrated in the available sources; no public exploit was identified at time of analysis, and a vendor patch is available in Scribus 1.6.7.
A heap buffer overflow in Scribus 1.6.x before 1.6.7 lets a crafted PICT/PCT file corrupt process memory when it is opened or placed through the PICT image loader or the PCT import plugin. The root cause is an unchecked bytesPerLine value used as the memcpy length into a QImage scanline, so a file whose bytesPerLine exceeds the destination row size overflows the heap, crashing the application and potentially allowing code execution with the user's privileges. Exploitation requires the victim to open or import the malicious file (local attack, user interaction), and a public PoC reference exists via the VulnCheck advisory; it is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation.
Heap out-of-bounds write in Scribus before 1.6.7 can be triggered when a user opens, imports, or places a crafted Photoshop PSD file that supplies channel-count values exceeding the real image channels or the loader's five-element component lookup array. This local, user-interaction-dependent flaw can crash Scribus and potentially execute code with the privileges of the user who opened the file; the fixed release is Scribus 1.6.7, and no public exploit was identified at time of analysis.
Heap out-of-bounds reads in Scribus before 1.6.7 let a crafted Mac PICT/PCT image trigger a crash or leak bounded amounts of heap memory when the file is opened, placed on a document, or imported. Exploitation requires the victim to open or import a malicious image (CVSS 4.0 UI:P, AV:L), and because the condition is read-only, the realistic outcomes are denial of service and limited information disclosure rather than code execution. No public exploit code has been identified at time of analysis; a vendor fix is available in Scribus 1.6.7 via commit d667b3b1d38e1808721315dc976d67b72070f6b4.
Out-of-bounds heap reads and writes in Scribus's SVM import plugin (importsvm) before 1.6.7 can crash the application or potentially enable code execution when a user opens a crafted StarView Metafile whose bitmap and transparency-mask dimensions disagree. The issue is local and requires user interaction to import the malicious file, and no public exploit was identified at time of analysis. It is a moderate-priority file-parsing memory-corruption issue rather than a mass-exploitation emergency, and the vendor has released Scribus 1.6.7 with fixes for the affected parsing path.
Heap buffer overflow in Scribus before 1.6.7, in both the Mac PICT image data loader and the pct import plugin, lets a crafted .pict/.pct file whose declared width is inconsistent with its actual row data write past the end of a heap buffer when the image is placed or imported, crashing Scribus or potentially achieving code execution. The attack is local and gated on user interaction: the victim must actively open, place, or import the malicious image (no privileges required, no network-facing or unattended vector), and no public exploit has been identified at time of analysis. Version 1.6.7 addresses the flaw by bounding copy lengths and nibble-expansion loops against the real scanline and source buffer sizes.
Heap-based out-of-bounds write in Scribus's Micrografx Draw (.DRW) import plugin (importdrw) before 1.6.7 allows local attackers to corrupt memory when a victim imports a crafted DRW file, resulting in a crash or potentially code execution. The plugin uses an unvalidated y offset to select image scanlines while decoding bitmap data, so writes can occur past the allocated heap image buffer; the attack is file-driven and requires user interaction to import the malicious document. No public exploit code or active exploitation has been identified at the time of analysis, and the vendor fix is Scribus 1.6.7.
Integer overflow in Scribus' TIFF tile loader (scimgdataloader_tiff) before 1.6.7 lets a crafted tiled TIFF corrupt heap memory when a user imports it into the application, crashing Scribus and potentially allowing code execution under the importing user's privileges. The flawed step is the 32-bit size calculation used to allocate the tile buffer (TILEWIDTH x TILELENGTH x sizeof(uint32_t)), so an attacker who supplies large tile width, height and sample values causes an undersized allocation that libtiff then fills with tile data. Triggering it is local and requires passive user interaction (CVSS:4.0 AV:L/PR:N/UI:P; assessed as CVSS:3.1 AV:L/AC:L/PR:N/UI:R), and while the heap corruption is confirmed by the upstream fix, reliable code execution depends on heap layout and is not demonstrated in the available sources; no public exploit was identified at time of analysis, and a vendor patch is available in Scribus 1.6.7.
A heap buffer overflow in Scribus 1.6.x before 1.6.7 lets a crafted PICT/PCT file corrupt process memory when it is opened or placed through the PICT image loader or the PCT import plugin. The root cause is an unchecked bytesPerLine value used as the memcpy length into a QImage scanline, so a file whose bytesPerLine exceeds the destination row size overflows the heap, crashing the application and potentially allowing code execution with the user's privileges. Exploitation requires the victim to open or import the malicious file (local attack, user interaction), and a public PoC reference exists via the VulnCheck advisory; it is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation.
Heap out-of-bounds write in Scribus before 1.6.7 can be triggered when a user opens, imports, or places a crafted Photoshop PSD file that supplies channel-count values exceeding the real image channels or the loader's five-element component lookup array. This local, user-interaction-dependent flaw can crash Scribus and potentially execute code with the privileges of the user who opened the file; the fixed release is Scribus 1.6.7, and no public exploit was identified at time of analysis.
Heap out-of-bounds reads in Scribus before 1.6.7 let a crafted Mac PICT/PCT image trigger a crash or leak bounded amounts of heap memory when the file is opened, placed on a document, or imported. Exploitation requires the victim to open or import a malicious image (CVSS 4.0 UI:P, AV:L), and because the condition is read-only, the realistic outcomes are denial of service and limited information disclosure rather than code execution. No public exploit code has been identified at time of analysis; a vendor fix is available in Scribus 1.6.7 via commit d667b3b1d38e1808721315dc976d67b72070f6b4.