-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Thu, 03 Sep 2026 10:20:32 +0200 Source: libheif Built-For-Profiles: noudeb Architecture: source Version: 1.23.3-1 Distribution: unstable Urgency: medium Maintainer: Debian Multimedia Maintainers <debian-multimedia@lists.debian.org> Changed-By: Joachim Bauch <fancycode@debian.org> Changes: libheif (1.23.3-1) unstable; urgency=medium . * New upstream version 1.23.3 * Fixes CVE-2026-84450, CVE-2026-84451. * Fixes heap buffer overflow (write) in the uncompressed (unci) mixed- interleave decoder when the two chroma components declare different bit depths. See upstream commit 9d3cd91 (GHSA-x8r2-mggj-j6wr). * Fixes decoder deadlock (DoS) via alpha-aux reference cycle. See upstream commit a83fd7b (GHSA-8fmq-r4pf-7m57). * Fixes heap out-of-bounds read in the YCbCr 4:2:0 to 16-bit interleaved RGB conversion. See upstream commit c37bf2b (GHSA-w7mc-p8jc-p853). * Fixes heap buffer overflow in the SVT-AV1 encoder plugin when encoding a high-bit-depth alpha channel. See upstream commits 0839585 and 5c3ed28 (GHSA-4jqm-2x34-6f6r). * Fixes heap out-of-bounds read when converting odd-height 4:2:0 frames of an uncompressed (uncv) image sequence to RGB. See upstream commit fe48abf (GHSA-4h82-g446-83fm). * Fixes out-of-bounds read in the RGB to YCbCr identity-matrix color conversion. See upstream commit 8008614 (GHSA-9rj8-5mp5-26c9). Checksums-Sha1: 730723fe3bf0f1e4fbdfc5968c28f39b24299408 3844 libheif_1.23.3-1.dsc c51ebb00c8cffac024648ea3b9ad837dd93ec4fe 2178756 libheif_1.23.3.orig.tar.gz a687a7d32b15a97fbbafbb3ab1b75bebbef62af7 14936 libheif_1.23.3-1.debian.tar.xz da71aea01c6cfe7abc44b83d48975da2b868e8e2 16098 libheif_1.23.3-1_source.buildinfo Checksums-Sha256: f9c10239287337bfe782e020ce091cdeb97f77549bc3e44c2de0d7e00e471ca8 3844 libheif_1.23.3-1.dsc 11c1179e0e4bec33624b87f22ec42c1e993a40d946d44d26f9c431cf1456a863 2178756 libheif_1.23.3.orig.tar.gz 9f41f861b576ee6ef77f4d20924b240f76d9d86845b604526be90be3168f39da 14936 libheif_1.23.3-1.debian.tar.xz 9df6ea9fa47a90efedf4eaf9e78257e7ec9fc2e5d3d9ba73f43bca8203759d72 16098 libheif_1.23.3-1_source.buildinfo Files: 3b31d376250beecd1f451d8ff8cdeeaf 3844 libs - libheif_1.23.3-1.dsc 0e3421a754cc79d4c5b3dbd18fb81d23 2178756 libs - libheif_1.23.3.orig.tar.gz 8d388a0b4b2441265d2c6069dd85b3b0 14936 libs - libheif_1.23.3-1.debian.tar.xz f53c86912d4c0f750f9e522f4ca1ad93 16098 libs - libheif_1.23.3-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEvj2K8Ga27IB5Zn/Xd8HSLVPhXwIFAmqZMPwACgkQd8HSLVPh XwLJ8Q//RK/tmZ9cNJ2tnHemj14KmzJxlnI1jCZZdXRGlF4gbTJY6wh43D+7m+da MTzoQRl6aEm0DU5ukyPMDrn5r2ECbBQ0Awn6mw92Mb4ErvRHUV+KrvUrvEOPrkWI Sn7Gm611lYXlwnVSo+fXrgddhK/bBPMH3YqDzpC3xkeWL4BtzJCU0QRrJb8J5CQU XxXvo3HpLdY0i3an4AkEYCMMSB/QTLA3UyxIn8/QspI0TCvc6v/gC/Oa3RySmB/+ M/bLDrU77sR2GJ1q5yuur8Xa6pldCUQpjLL6i1ETNU8XY8nsSliAS7rR8kRMrmOV o5Yu28WbSelGZT3IqEcKcS6EHeWV7kuhbZ7GwteIyBA0dVsu4/zY8zUO5gNDGZUF GqovSZQ0HB/IwKh61L2FhFtDVS9kZdhXT8jHQdElZjkYPt8NN9dUwvBKKOGbNhm/ J0cy9ow623rXTcW5h1YgOBtr0t6lCvj/z43FScFECRW+9IKDpa0EDzDB9j+4cGRw znRKTOKyzGrFS2B0Xtgm2wtA/QG8CJw1ycTst4wnc0u08rayqNMfrJkTtWa5tKF9 NbewQ17oTq5d5/5Hv8kFjHzO2O2Qgd3MyxPXvwlXeio+uraYbWgHsGWBvWdpfWfu QTF+xWjlwWnFVcMvo1kFRMc8e6s5dRuoKcsawIWG95CCSL9aurQ= =0j5B -----END PGP SIGNATURE-----
