Threats tagged 'ghsa-x847-96w4-ch3j'

Scribus versions prior to 1.6.7 have an out-of-bounds memory access vulnerability in the importsvm plugin. This flaw occurs because the plugin does not verify that bitmap and transparency mask dimensions match when importing SVM files. An attacker can craft a malicious SVM file with mismatched mask dimensions to trigger heap reads and writes, potentially causing application crashes or arbitrary code execution with the privileges of the user running Scribus.