Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd…

What to know

What it is

Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code execution as the user.

Affected

See advisory

Fix

Upgrade the product to 1.6.7 or later.

Exploitation

No known exploitation