OPENSUSE-SU-2026:22239-1 Security update for GraphicsMagick

This update for GraphicsMagick fixes the following issues: - CVE-2026-103118: uncontrolled recursion in the WPG file handler when processing crafted WPG files which are self- referencing bsc1283767. - CVE-2026-109964: heap buffer underwrite in DecodeImage of in PICT decoder due to pointer...

CVE-2026-104063

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leadi...

CVE-2026-104062

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage...

CVE-2026-104066

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out...

SUSE CVE-2026-104062

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage...

SUSE CVE-2026-104063

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leadi...

SUSE CVE-2026-104066

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out...

CVE-2026-120433

A flaw was found in Netpbm. This vulnerability allows an attacker to achieve arbitrary code execution or cause a Denial of Service DoS by tricking a user or system into processing a specially crafted image file. A lack of boundary checking in the picttoppm utility allows a polygon with an excessi...

CVE-2026-120433

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array...

EUVD-2026-115194

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in picttoppm's scanPoly function in converter/ppm/picttoppm.c. Attackers can supply a crafted PICT file whose polygon edges produce more than 5000 points, overflowing the coord stack arr...

EUVD-2026-115193

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array...

Linux Distros Unpatched Vulnerability : CVE-2026-104063

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pix...

Linux Distros Unpatched Vulnerability : CVE-2026-104066

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit...

Linux Distros Unpatched Vulnerability : CVE-2026-120433

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly function due to an...

Linux Distros Unpatched Vulnerability : CVE-2026-104062

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to...

PT-2026-135449

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array...

CVE-2026-104063

A flaw was found in Scribus. When decoding planar pixel data in the Mac PICT image loader, the application does not properly validate image dimensions, leading to an out-of-bounds read vulnerability. By convincing a user to import or open a specially crafted PICT file, an attacker can trigger an...

CVE-2026-104066

A flaw was found in Scribus. By tricking a user into importing or placing a specially crafted Macintosh Picture PICT image file with inconsistent dimension data, an attacker can trigger a heap-based buffer overflow during pixel unpacking. This flaw can allow an attacker to achieve arbitrary code...

CVE-2026-104062

A flaw was found in Scribus. This flaw allows an attacker to achieve arbitrary code execution or cause a denial of service DoS by convincing a user to open or import a specially crafted PICT image file. The issue occurs due to improper boundary checks in the PICT image loader and import plugin,...

CVE-2026-104066

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out...