-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Thu, 17 Sep 2026 21:27:18 +0200 Source: libheif Built-For-Profiles: noudeb Architecture: source Version: 1.23.4-1 Distribution: unstable Urgency: medium Maintainer: Debian Multimedia Maintainers <debian-multimedia@lists.debian.org> Changed-By: Joachim Bauch <fancycode@debian.org> Closes: 1148137 Changes: libheif (1.23.4-1) unstable; urgency=medium . * New upstream version 1.23.4 * Various security fixes (Closes: #1148137): - Fixes unbound parsing of iinf child boxes. See upstream commits 2ebb06f, 19fd108, eb339b7 and 92b79c6 (GHSA-vg7w-rp49-4fc2). - Fixes unbounded recursion when checking reference cycles. See upstream commits b1e4d72 and 7538a4f (GHSA-xrp2-63fq-jm8q). - Fixes decoder deadlock through lock-order inversion. See upstream commit f8beb40 (GHSA-prgh-72vc-3xmc). - Fixes heap out-of-bounds read when encoding images with different luma and chroma bit depths. See upstream commit 51360e1 (GHSA-fqpw-fj22-78w4). - Fixes memory leak in heif_track_get_next_raw_sequence_sample. See upstream commit 3d9c246 (GHSA-4rv4-953r-p24q). - Fixes heap out-of-bounds read in the WebCodecs decoder plugin. See upstream commits fb8d945 and 604d837 (GHSA-rhgw-q5g8-xjh2). Checksums-Sha1: e40e673f19806fd490ce21ec6bf32fc1aa5d7b42 3844 libheif_1.23.4-1.dsc f8ab778f373973dcada7c77236d711e1310cc26a 2217221 libheif_1.23.4.orig.tar.gz c2264734e5ea7149a6a3c75c569e486878d6fabe 15244 libheif_1.23.4-1.debian.tar.xz 08c6d17f9dd6b1dee41357bde3e8ff68d8630d80 16104 libheif_1.23.4-1_source.buildinfo Checksums-Sha256: 042456f22e06a4cbc878b59de2ff803d3edf636ee4b12506885e3b6bdcf586c6 3844 libheif_1.23.4-1.dsc d0c02b4b0e978f34a1974b6f3eea7975a537bf7a9195ffeea38e7242ff316fdd 2217221 libheif_1.23.4.orig.tar.gz bafcccab0e63fa72461c47c95e0235b16e9d091b64535c44d7c2d2e9864a25ca 15244 libheif_1.23.4-1.debian.tar.xz d77f09f3e9878e62af44a81a0ab0666de411e9c97aed39c5cfdd9cad9c2ea4a5 16104 libheif_1.23.4-1_source.buildinfo Files: 9c26f303cea0f76e884528329723b047 3844 libs - libheif_1.23.4-1.dsc 9cd6d40e19496a839dc9a7ba0b750f76 2217221 libs - libheif_1.23.4.orig.tar.gz 90dab9bd4d7efcb2a1a7550b3887a3d1 15244 libs - libheif_1.23.4-1.debian.tar.xz a81bf698cef82d0b284d33945dddea57 16104 libs - libheif_1.23.4-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEvj2K8Ga27IB5Zn/Xd8HSLVPhXwIFAmqsPzwACgkQd8HSLVPh XwJ8DQ/9FUtlQi3HLJzHHujXqFjV7CGvJTjR60mWk+UIlVQmJ6ewVVk3ASLfTUOx NhzaGLDCm0jq+JLdVwE+BGC99waPeYrX2+UteGzWdh9CsJgCyHCacbkiv7FbdE+/ ZN0EW9+2QzBUZqsTPZyR77GKHkHcoGkVG5BuaoIUzeOAOctLbBSfeopTmvx+m20k AZ6Ee25uA+Z3pxP5wq4RmJEj0andaL9KR/9XpiixLX/MBCJ0wDXTVxuGKoOG6cwc I1/txS1tG9TUISW89yh6B/AHLvMwpUBAerR2vlPYCyjytamIIvwQ/kG9u8ac9XwI Rxx/zi5blFj2ZxnYAjIFZTI4vFjAz7A5oWaskgtyYugP/H6Kkf6s0O5oQ/SAM0F3 c7pWRANrFsD1gFln7pKjLYSFzZugsAARdfj1MQjIAC8bVOz5kpQxs5ViFrwSzxoq YiMhx/VBrSt5jPDSE/olx8kQTBDbz7wIif/Ov4pXchcBVXOTTHrDQwTXMYh+xWHv nkq7Bcan2UuxaZLGuoefrj1A1C38Hu+LKTKS7vgWFa2PJSgiuqbMyOQiTHQY4xx1 Gtq3bdkFwPXzmC8E5SQ+ZwV2DW1PFGPNS0haZTd5ZS0wjCyej4+hIIT8gqgYCHgq mmUXCrwLsbomC2vd9yMm11P8J4ExJfC83I/CZL+HnEwVFXX8myw= =1cvK -----END PGP SIGNATURE-----
