[Scribus] freetype font parsing vulnerabilities

[Andreas Vox]

To all Linux users...


Maybe you already heard about this security alert:

http://scary.beasts.org/security/CESA-2006-001.html

 From what I can tell this can also affect Scribus if you install
a manipulated font file or if you open a Scribus document which
is in the same folder as a manipulated font file.

I don't think you can use Scribus to embed manipulated fonts
into PS or PDF documents.

The main risk is of course using such fonts in X11, or viewing
manipulated PS/PDF files with viewers which use freetype (such as xpdf).

I'd advise to upgrade to freetype 2.2.1 as soon as possible.
If your system does not support freetype 2.2.x yet you should be
careful when opening files with embedded fonts.

Cheers
/Andreas