UbuntuUpdates.org

Package "libheif"

Name: libheif

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • HEIF and AVIF file format decoder and encoder - heif sequence viewer
  • HEIF and AVIF file format decoder and encoder - development files
  • HEIF and AVIF file format decoder and encoder - dav1d plugin
  • HEIF and AVIF file format decoder and encoder - ffmpegdec plugin
Latest version: 1.21.2-3ubuntu0.6
Release: resolute (26.04)
Level: updates
Repository: universe

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "libheif" in Resolute

Repository Area Version
base universe 1.21.2-3
base main 1.21.2-3
security main 1.21.2-3ubuntu0.7
security universe 1.21.2-3ubuntu0.7
updates main 1.21.2-3ubuntu0.6

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.21.2-3ubuntu0.6 2026-09-29 20:07:30 UTC

libheif (1.21.2-3ubuntu0.6) resolute-security; urgency=medium

  * SECURITY UPDATE: Denial of service in HEIF or AVIF metadata parsing
    - debian/patches/CVE-2026-84384-pre1.patch: add
      HeifFile::get_security_limits() getter in libheif/file.h
    - debian/patches/CVE-2026-84384-pre2.patch: catch C++ exceptions at the
      read/decode C API entry points in libheif/api_structs.h,
      libheif/error.h, ../error.cc, libheif/api/libheif/heif_context.cc,
      ../heif_decoding.cc, ../heif_sequences.cc and ../heif_tiling.cc
    - debian/patches/CVE-2026-84384.patch: bound brotli/zlib decompression
      output in libheif/compression.h, ../compression_brotli.cc,
      ../compression_zlib.cc, ../context.cc, ../file.cc,
      libheif/image-items/image_item.h,
      libheif/codecs/uncompressed/decoder_abstract.cc, and
      ../decoder_abstract.h
    - CVE-2026-84384
  * SECURITY UPDATE: Denial of service in HEIF parsing
    - debian/patches/CVE-2026-84446-pre1.patch: add calloc-style
      MemoryHandle::alloc() overload with integer-overflow checking in
      libheif/security_limits.cc and ../security_limits.h
    - debian/patches/CVE-2026-84446-pre2.patch: add
      heif_track_get_number_of_repetitions() API and supporting helpers in
      libheif/api/libheif/heif_sequences.h, ../heif_sequences.cc,
      libheif/context.cc, ../context.h, libheif/sequences/seq_boxes.h,
      ../track.cc and ../track.h
    - debian/patches/CVE-2026-84446.patch: Fix sequence timing-table DoS in
      libheif/api/libheif/heif_sequences.cc, libheif/sequences/chunk.cc,
      ../chunk.h, ../seq_boxes.cc, ../seq_boxes.h, ../track.cc and ../track.h
    - CVE-2026-84446
  * SECURITY UPDATE: Unbound allocation in reference graphs
    - debian/patches/CVE-2026-84447.patch: Bound derived-image reference
      amplification in libheif/context.cc, ../context.h, ../file.cc,
      ../file.h, libheif/image-items/grid.cc, ../grid.h, ../iden.cc,
      libheif/image-items/iden.h, ../image_item.cc, ../image_item.h,
      ../mask_image.cc, ../mask_image.h, ../overlay.cc, ../overlay.h,
      ../tiled.cc, ../tiled.h, ../unc_image.cc, ../unc_image.h,
      libheif/security_limits.h
    - CVE-2026-84447
  * SECURITY UPDATE: Denial of service in
    heif_region_item_add_region_inline_mask_data
    - debian/patches/CVE-2026-84448-pre1.patch: advance the parse offset after
      inline mask data in libheif/region.cc
    - debian/patches/CVE-2026-84448.patch: Validate inline mask data length
      in region writer API in libheif/api/libheif/heif_regions.cc and
      ../heif_regions.h
    - CVE-2026-84448

 -- Kyle Kernick Thu, 24 Sep 2026 13:00:45 -0600
Source diff to previous version
CVE-2026-84384 libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can caus
CVE-2026-84446 libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::init_sam
CVE-2026-84447 libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decod
CVE-2026-84448 libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in li

Version: 1.21.2-3ubuntu0.5 2026-09-16 22:07:35 UTC

libheif (1.21.2-3ubuntu0.5) resolute-security; urgency=medium

  * SECURITY UPDATE: Out-of-bounds write in decoder/encoder
    - debian/patches/CVE-2026-62291.patch: Reject uncompressed encode of
      images with mismatched component plane sizes in
      libheif/image-items/unc_image.cc and ../unc_image.h
    - CVE-2026-62291
  * SECURITY UPDATE: Denial of service in heif_context_read_from_memory
    - debian/patches/CVE-2026-62377.patch: Return error instead of asserting
      in libheif/context.cc
    - CVE-2026-62377

 -- Kyle Kernick Tue, 15 Sep 2026 11:03:16 -0600
Source diff to previous version
CVE-2026-62291 libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 au
CVE-2026-62377 libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory(

Version: 1.21.2-3ubuntu0.4 2026-08-19 16:08:48 UTC
No changelog available yet.
Source diff to previous version

Version: 1.21.2-3ubuntu0.3 2026-07-10 01:09:30 UTC

  libheif (1.21.2-3ubuntu0.3) resolute-security; urgency=medium

  * SECURITY UPDATE: Heap Buffer Overflow in Track::get_next_sample_raw_data
    - debian/patches/CVE-2026-47254-1.patch: Validate stsc sample coverage
      in libheif/sequences/track.cc
    - debian/patches/CVE-2026-47254-2.patch: add defensive check in
      init_sample_timing_table() in libheif/sequences/track.cc
    - CVE-2026-47254
  * SECURITY UPDATE: Integer overflow when parsing uncC.
    - debian/patches/CVE-2026-47709-1.patch: Prevent integer overflow
      when parsing uncC in libheif/codecs/uncompressed/unc_boxes.cc
    - debian/patches/CVE-2026-47709-2.patch: Reject unci images with no ispe
      box in libheif/image-items/unc_image.cc
    - CVE-2026-47709
  * SECURITY UPDATE: Integer overflow in inline mask size calculation
    - debian/patches/CVE-2026-47714.patch: Fix computation of size of inline
      region mask in libheif/region.cc
    - CVE-2026-47714
  * SECURITY UPDATE: OOB read in ImageItem_Grid::decode_grid_tile.
    - debian/patches/CVE-2026-48029.patch: Fix tile coordinates validation
      in rotated images in libheif/api/libheif/heif_tiling.cc and
      libheif/image-items/image_item.cc
    - CVE-2026-48029
  * SECURITY UPDATE: Unbounded heap allocation in sequence parser.
    - debian/patches/CVE-2026-50142.patch: Fix check against security limit
      in libheif/sequences/seq_boxes.cc and ../track.cc
    - CVE-2026-50142

 -- Kyle Kernick <email address hidden> Tue, 07 Jul 2026 12:04:31 -0600
Source diff to previous version

Version: 1.21.2-3ubuntu0.2 2026-06-29 20:07:29 UTC

  libheif (1.21.2-3ubuntu0.2) resolute-security; urgency=medium

  * SECURITY UPDATE: Out-of-bound memory access in tiled chroma decode.
    - debian/patches/CVE-2026-47178.patch: Fix heap OOB in
      libheif/codecs/uncompressed/decoder_component_interleave.cc,
      ../decoder_mixed_interleave.cc, and tests/uncompressed_encode.cc
    - CVE-2026-47178
  * SECURITY UPDATE: Integer overflow in UNCI.
    - debian/patches/CVE-2026-49271.patch: Prevent integer overflow
      when reading compressed data in
      libheif/codecs/uncompressed/decoder_abstract.cc
    - CVE-2026-49271

 -- Kyle Kernick <email address hidden> Tue, 23 Jun 2026 15:00:39 -0600
CVE-2026-49271 libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed


About   -   Send Feedback to @ubuntu_updates