UbuntuUpdates.org

Package "libheif1"

Name: libheif1

Description:

ISO/IEC 23008-12:2017 HEIF file format decoder - shared library
Latest version: 1.17.6-1ubuntu4.9
Release: noble (24.04)
Level: security
Repository: main
Head package: libheif
Homepage: http://www.libheif.org

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libheif1"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "libheif1" in Noble

Repository Area Version
base main 1.17.6-1ubuntu4
updates main 1.17.6-1ubuntu4.9

Changelog

Version: 1.17.6-1ubuntu4.9 2026-09-29 18:07:18 UTC

libheif (1.17.6-1ubuntu4.9) noble-security; urgency=medium

  * SECURITY UPDATE: Denial of service in HEIF or AVIF metadata parsing
    - debian/patches/CVE-2026-84384.patch: bound brotli/zlib decompression
      output in libheif/metadata_compression.cc
    - CVE-2026-84384
  * SECURITY UPDATE: Denial of service in
    heif_region_item_add_region_inline_mask_data
    - debian/patches/CVE-2026-84448-pre1.patch: advance the parse offset after
      inline mask data in libheif/region.cc
    - debian/patches/CVE-2026-84448.patch: Validate inline mask data length
      in region writer API in libheif/heif_regions.cc and
      ../heif_regions.h
    - CVE-2026-84448
  * SECURITY UPDATE: Integer overflow in image plane stride handling
    - debian/patches/CVE-2026-84449.patch: changed internal stride types
      from int to size_t and added an overflow guard at the public C API
      boundary in libheif/heif.cc, ../heif.h, ../uncompressed_image.cc,
      ../color-conversion/chroma_sampling.cc, ../hdr_sdr.cc,
      ../monochrome.cc, ../rgb2rgb.cc, ../rgb2yuv.cc,
      ../rgb2yuv_sharp.cc, ../yuv2rgb.cc, libheif/context.cc,
      ../pixelimage.cc, ../pixelimage.h, and libheif/mask_image.cc.
    - CVE-2026-84449

 -- Kyle Kernick Mon, 28 Sep 2026 11:26:33 -0600
Source diff to previous version
CVE-2026-84384 libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can caus
CVE-2026-84448 libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in li
CVE-2026-84449 libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, Op_RGB24_32_to_YCbCr::convert_colorspace() stores image-plane strides in

Version: 1.17.6-1ubuntu4.8 2026-08-26 18:07:23 UTC
No changelog available yet.
Source diff to previous version

Version: 1.17.6-1ubuntu4.7 2026-08-19 15:08:26 UTC
No changelog available yet.
Source diff to previous version

Version: 1.17.6-1ubuntu4.6 2026-07-14 18:08:57 UTC

  libheif (1.17.6-1ubuntu4.6) noble-security; urgency=medium

  * SECURITY UPDATE: Integer overflow when parsing uncC.
    - debian/patches/CVE-2026-47709.patch: Prevent integer overflow
      when parsing uncC in libheif/uncompressed_image.cc
    - CVE-2026-47709
  * SECURITY UPDATE: Integer overflow in inline mask size calculation
    - debian/patches/CVE-2026-47714.patch: Fix computation of size of inline
      region mask in libheif/region.cc
    - CVE-2026-47714

 -- Kyle Kernick <email address hidden> Mon, 13 Jul 2026 16:00:17 -0600
Source diff to previous version

Version: 1.17.6-1ubuntu4.4 2026-06-18 18:07:34 UTC

  libheif (1.17.6-1ubuntu4.4) noble-security; urgency=medium

  * SECURITY UPDATE: Buffer overflow when reading mask image.
    - debian/patches/CVE-2026-32741.patch: Fix possible buffer overflow when
      reading mask image in libheif/image-items/mask_image.cc
    - CVE-2026-32741
  * SECURITY UPDATE: Information leak in decode.
    - debian/patches/CVE-2026-32814.patch: Initialize allocated memory to
      avoid information leak in libheif/pixelimage.cc
    - CVE-2026-32814
  * SECURITY UPDATE: Heap overflow in HeifPixelImage.
    - debian/patches/CVE-2026-32882.patch: Fix overlay image with alpha
      channels with stride different from color channel in
      libheif/pixelimage.cc
    - CVE-2026-32882

 -- Kyle Kernick <email address hidden> Tue, 16 Jun 2026 17:16:55 -0600
CVE-2026-32741 libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and below contain a heap buffer overflow in MaskImageCodec::decode_mask_i
CVE-2026-32814 libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decoding=false
CVE-2026-32882 libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap buffer over-read in HeifPixelImage::overlay() in


About   -   Send Feedback to @ubuntu_updates