-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Sat, 10 Oct 2026 23:24:21 +0200
Source: libheif
Built-For-Profiles: noudeb
Architecture: source
Version: 1.23.6-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Multimedia Maintainers <debian-multimedia@lists.debian.org>
Changed-By: Joachim Bauch <fancycode@debian.org>
Changes:
libheif (1.23.6-1) unstable; urgency=medium
.
* New upstream version 1.23.6
* Various security fixes:
- Fixes memory exhaustion through container and bitstream image size
mismatch. See upstream commit 6ce2bba (GHSA-v8qw-hwjv-44hw).
- Fixes heap use-after-free and double free when encoding image with
TAI timestamp. See upstream commit 45a40ca (GHSA-qwpf-5wf7-r996).
- Fixes memory amplification through a JPEG 2000 pclr box. See
upstream commit ba47ddd (GHSA-9c75-9g8r-4728).
- Fixes heap out-of-bounds read in alpha compositing for uncompressed
(unci) images. See upstream commits e379fd5 and 6f58ba3
(GHSA-r7gr-2xm2-23wf).
- Fixes incomplete OpenJPEG pre-decode security limits allowing
unsafe decode through the public API.
See upstream commit a44ad89 (GHSA-q492-cfcm-895h).
- Fixes heap out-of-bounds read in the uncompressed encode.
See upstream commit c727622 (GHSA-qfj5-c4pq-q998).
- Fixes applying heif_security_limits when parsing a mini box or the
av1C/hvcC blob embedded in it.
See upstream commit 24219cb (GHSA-7pwf-qh74-p35w).
* Unpackaged upstream version 1.23.5 contains the following security
fixes:
- Fixes enforcing max_items security limit for the child boxes of iinf.
See upstream commits 2ebb06f, 19fd108, eb339b7 and 92b79c6
(GHSA-vg7w-rp49-4fc2).
- Fixes unbounded iref entry list and unbounded recursion in the
reference-cycle check.
See upstream commits b1e4d72 and 7538a4f (GHSA-xrp2-63fq-jm8q).
- Fixes permanent decoder deadlock through a lock-order inversion in
parallel grid tile decoding. See upstream commit f8beb40
(GHSA-prgh-72vc-3xmc).
- Fixes heap out-of-bounds read in the encoder plugins. See upstream
commit 51360e1 (GHSA-fqpw-fj22-78w4).
- Fixes unreclaimable memory leak in
heif_track_get_next_raw_sequence_sample.
See upstream commit 3d9c246 (GHSA-4rv4-953r-p24q).
- Fixes heap out-of-bounds read in the WebCodecs decoder plugin.
See upstream commits fb8d945 and 604d837 (GHSA-rhgw-q5g8-xjh2).
* Enable kvazaar plugin on loong64 now that #1127385 is resolved.
Checksums-Sha1:
babab42c80e8ab9f4e5fd94de1da473a09a7e043 3736 libheif_1.23.6-1.dsc
092204a0715469ee0f84134c9db3e86375dec587 2373898 libheif_1.23.6.orig.tar.gz
39015927f6410eb88f1df31c6d85636d585faf74 15720 libheif_1.23.6-1.debian.tar.xz
1347c49239d2a5f1d10ad5dfef27972bfe955048 16110 libheif_1.23.6-1_source.buildinfo
Checksums-Sha256:
8ef81773365fef1bb4635e20ccd5dac2f5f56c0f3f28a8e02ff99b794d731155 3736 libheif_1.23.6-1.dsc
4484346dc5995319dbc11e3a1c35d0a2ec46511ce370900869337fd2c7033125 2373898 libheif_1.23.6.orig.tar.gz
fb03abbbdf48fe36891d7baa9abb5b43f947a9b9fe6880381f2368cbc76f0668 15720 libheif_1.23.6-1.debian.tar.xz
60141564fd55f72bca964910513b5d2b6f1ae9d7460d1947f888e712363b677e 16110 libheif_1.23.6-1_source.buildinfo
Files:
1cb1ad01f80ddbf4038d29f78b9f7b85 3736 libs - libheif_1.23.6-1.dsc
1e95c96fc0d3b8c40023b4b1a7184dab 2373898 libs - libheif_1.23.6.orig.tar.gz
d1fd05b4c92f2e627edcb657eefdd7d1 15720 libs - libheif_1.23.6-1.debian.tar.xz
8ee08a4ca24467102937bd3368fcd5dd 16110 libs - libheif_1.23.6-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEvj2K8Ga27IB5Zn/Xd8HSLVPhXwIFAmrKrWEACgkQd8HSLVPh
XwIZWw/9Eju016cegZVO1oKSqSIGOHO0J9P3j3GbbOvY6xONW8GxRn+54XiZt3g6
FXgD0/v3KQMLiYpOao7pNkDKHPEr3k/3Ude+W41XJR+HvtOV2zEw7JCEPnUTeMXK
QH0QM6xD/JH963uo39QmF+LYkaJPe/K6TKWOh/sT49bRgC2ry48cJ3WyBsjxTRTL
/2NSQQYj1V+2KVPfM/H71WyBP4xNQ05OlioniykC+3iIlVHYf7rkEegUFubOuVdb
twBMSmCpA0nUI7e1XybQUBqbsxRdLyhAiP1JjiZofrQch0NaQ9D/P5kj+Q33zN18
6AbvYW/iezwQE5eK9rG5JS+Q+P03cKCqhibT7r+rYwenFTYKbheTOSQ3lvFKA5EQ
BWTpmR9IGDGOlExKIV2jqDxoAVCNYmAFwieor2+pY5UKyBbZZgGYUkx8f8NHq5m5
cGPzZbTiFoyknYXnfbcNTE+EOxpvg2PURaiMnH0xJgj2PO8Ps1DCiCm0nuRbtyYS
8t8yrEjvZnND1uaLNGD1gxSVWVSTLX6ngXIYBVGJjW7f7dMHYzeW40G/cW474Rp7
/6MsoreZbylEiFFuIdq9Cx+ihGeWOYK8GMgkNh5fzGIqdQyvxLWXBLHsYV5vjLZU
gCwGiOg5O70wdUfm7QF6GF0h2+xituyururE6YOQezp41aTytkA=
=ArVj
-----END PGP SIGNATURE-----
