-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 09 Sep 2026 14:41:39 +0800
Source: libheif
Architecture: source
Version: 1.23.4-1~deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Debian Multimedia Maintainers <debian-multimedia@lists.debian.org>
Changed-By: Aron Xu <aron@debian.org>
Changes:
libheif (1.23.4-1~deb13u1) trixie-security; urgency=high
.
* Non-maintainer upload by the Security Team.
* New upstream release 1.23.4:
- CVE-2026-84450: assertion failure in Fraction::Fraction when a "clap"
box is combined with an oversized "ispe"; incomplete fix for
GHSA-jc8f-p23p-5hjg.
- CVE-2026-84451: out-of-bounds read; incomplete fix for
GHSA-73p7-m7gg-w2jv.
- CVE-2026-3949: out-of-bounds read in code, not enabled in Debian build.
- GHSA-x8r2-mggj-j6wr: heap buffer overflow (write) in the uncompressed
(unci) mixed-interleave decoder when the two chroma components declare
different bit depths.
- GHSA-w7mc-p8jc-p853: heap out-of-bounds read in the YCbCr 4:2:0 to
16-bit interleaved RGB colour conversion.
- GHSA-4jqm-2x34-6f6r: heap buffer overflow in the SVT-AV1 encoder plugin
when encoding a high-bit-depth alpha channel.
- GHSA-9rj8-5mp5-26c9: out-of-bounds read in the RGB to YCbCr
identity-matrix colour conversion.
- GHSA-vg7w-rp49-4fc2: the max_items security limit was not enforced on
"iinf" child boxes, "iref" reference entries were not capped, Box_iref
references are now indexed by from_item_ID, and the Emscripten item-ID
helpers no longer use alloca.
- GHSA-5w8x-856j-7x7c: add_property() returned a property position
belonging to another item.
- GHSA-fqpw-fj22-78w4: encoder plugins did not validate the input image
before encoding it.
- GHSA-prgh-72vc-3xmc: cyclic decode reference graphs were not rejected
before decoding.
- GHSA-xrp2-63fq-jm8q: the decode-graph cycle check recursed without
bound; it is now an explicit worklist.
- GHSA-4rv4-953r-p24q: raw sequence sample leak and an unguarded C entry
point.
- GHSA-rhgw-q5g8-xjh2: coded/visible rectangle mismatch in the WebCodecs
decoder plugin.
* Do not build the heif-view tool so that the set of binary packages
stays identical to the one trixie already ships.
* d/control: Build libheif-plugin-kvazaar on all architectures again.
Checksums-Sha1:
8c768cc496e429d07d17da27708379ff0fac421e 3377 libheif_1.23.4-1~deb13u1.dsc
f8ab778f373973dcada7c77236d711e1310cc26a 2217221 libheif_1.23.4.orig.tar.gz
5b2ba1570b30816b0e1797aabf96fef6cd900ce3 15552 libheif_1.23.4-1~deb13u1.debian.tar.xz
84cc462f698110a28d1472055e5413c502e49df9 8087 libheif_1.23.4-1~deb13u1_source.buildinfo
Checksums-Sha256:
6bf7fbd3de53ba819c770f07946e20123ed460f3d8eabe579f22218c96bf82c1 3377 libheif_1.23.4-1~deb13u1.dsc
d0c02b4b0e978f34a1974b6f3eea7975a537bf7a9195ffeea38e7242ff316fdd 2217221 libheif_1.23.4.orig.tar.gz
5102677f6e7e98b9b80d19e7579617ae07fe56199e9c9ce91ce59c1e7a6e24aa 15552 libheif_1.23.4-1~deb13u1.debian.tar.xz
6c1ff0f1b2aa14ef18cd91dd467321c8e811a6d45a740f1e6fcdbe5479295e6c 8087 libheif_1.23.4-1~deb13u1_source.buildinfo
Files:
5a484d0b96a267dac3d01561b5b7680d 3377 libs optional libheif_1.23.4-1~deb13u1.dsc
9cd6d40e19496a839dc9a7ba0b750f76 2217221 libs optional libheif_1.23.4.orig.tar.gz
2b2d426040be8e9a6f4f4e089f116d68 15552 libs optional libheif_1.23.4-1~deb13u1.debian.tar.xz
36cb0a96955b3a4671a6c08210b1be18 8087 libs optional libheif_1.23.4-1~deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmq2UM0ACgkQ+GQ1dHE8
m674SAgAhjPkjVHYfIxLny1ckYoK9DqPBpfuw2XepwlQJtD6W9BlANzWTrtUODVr
/C0xovUzh6YqJp18XlwUbWhphItYLsPvC4tFOzseygNwqb2UPQ+5FhvPRDbuTV5D
q+/DnSgev8wNSi343QdDJ7kq6CEC6m9+5TpwidX58axbt9NvHKbRxgjztal1YtLK
/BKHfMbNt5rMCTMwwB6jt0GnFsCl7nTOPLwrZoVJiGfJ3Zakp01VgVkROst+djKh
l2FNRK0N/z0+k59QLVn5t94Yl84EWoSxBDgd8wmsL6L7FGj8tNFfQdQxLD1c4Ioi
HHXOKei6oBulG8bzkVS4hN+6B9z3+Q==
=V9Mp
-----END PGP SIGNATURE-----
