Jean Ghali

A heap out-of-bounds write issue exists in the `scimgdataloader psd` loader. The problem occurs because the loader uses unchecked PSD file values as lookup array indexes. An attacker can exploit this by tricking a user into importing or placing a specially crafted PSD file, which leads to heap memory corruption. This may result in application crashes or potential arbitrary code execution with the privileges of the user.

A heap buffer overflow exists in the PICT image loader and import plugin. This occurs when the software fails to check the `bytesPerLine` value, allowing an attacker to corrupt heap memory. By crafting a PICT file where `bytesPerLine` exceeds the QImage scanline size, a remote attacker can cause the application to crash or potentially execute arbitrary code with the privileges of the user.

An out-of-bounds read exists in the Mac PICT image loader and import plugin during the decoding of planar pixel data. A remote attacker can provide a specially crafted PICT file with manipulated dimensions that, when imported or placed, triggers heap over-reads. This can result in application crashes or the disclosure of sensitive heap memory.

An integer overflow exists in the `scimgdataloader tiff` TIFF loader. This flaw allows an attacker to trigger a heap overflow by providing a tiled TIFF file with excessively large tile width, height, and sample values. This memory corruption can lead to an application crash or arbitrary code execution.

The importdrw Micrografx Draw plugin contains an out-of-bounds write issue. This occurs because the plugin uses an unvalidated y offset to select image scanlines. A remote attacker can provide a specially crafted DRW file that, when imported, writes decoded bitmap data outside the heap image buffer, potentially leading to application crashes or arbitrary code execution.

A heap buffer overflow occurs in the Mac PICT image loader and import plugin during the unpacking of 4-bit indexed pixel data. A heap buffer overflow is a memory corruption issue where a program writes more data to a heap-allocated buffer than it can hold. An attacker can use a specially crafted PICT file containing inconsistent width and row data to trigger an out-of-bounds write when the file is placed or imported, potentially leading to application crashes or arbitrary code execution.

An out-of-bounds memory access issue exists in the `importsvm` plugin. The component fails to verify that bitmap and transparency mask dimensions match. A remote attacker can provide a specially crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, which may lead to application crashes or arbitrary code execution with the privileges of the user.