libheif - Debian Package Tracker

general

source: libheif (main)
version: 1.12.0-2
maintainer: Debian Multimedia Maintainers (archive) (DMD)
uploaders: Joachim Bauch [DMD]
arch: any
std-ver: 4.5.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 1.3.2-2~deb10u1
stable: 1.11.0-1
testing: 1.12.0-2
unstable: 1.12.0-2

versioned links

1.3.2-2~deb10u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.11.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.12.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

heif-gdk-pixbuf (1 bugs: 0, 1, 0, 0)
heif-thumbnailer
libheif-dev
libheif-examples
libheif1

action needed

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2020-23109: Buffer overflow vulnerability in function convert_colorspace in heif_colorconversion.cc in libheif v1.6.2, allows attackers to cause a denial of service and disclose sensitive information, via a crafted HEIF file.

Created: 2021-11-03 Last update: 2021-12-09 11:34

1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:

CVE-2020-23109: Buffer overflow vulnerability in function convert_colorspace in heif_colorconversion.cc in libheif v1.6.2, allows attackers to cause a denial of service and disclose sensitive information, via a crafted HEIF file.

Created: 2021-11-03 Last update: 2021-12-09 11:34

lintian reports 1 error high

Lintian reports 1 error about this package. You should make the package lintian clean getting rid of them.

Created: 2021-11-05 Last update: 2021-11-05 04:33

Multiarch hinter reports 1 issue(s) normal

There are issues with the multiarch metadata for this package.

heif-gdk-pixbuf could be marked Multi-Arch: same

Created: 2021-01-03 Last update: 2022-01-26 06:38

2 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 69b6226cb85c4239d4ed02c96e929f36d7f3b042
Merge: 90f6615 b546740
Author: Sebastian Ramacher <sramacher@debian.org>
Date:   Tue Sep 7 10:41:47 2021 +0000

    Merge branch 'lintian-fixes' into 'master'
    
    Set upstream metadata fields: Bug-Database, Bug-Submit, Repository, Repository-Browse
    
    See merge request multimedia-team/libheif!1

commit b5467408745e2bfe30bfdd7f5775cf33330ccfab
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Sun Sep 5 17:47:38 2021 +0000

    Set upstream metadata fields: Bug-Database, Bug-Submit, Repository, Repository-Browse.
    
    Changes-By: lintian-brush
    Fixes: lintian: upstream-metadata-file-is-missing
    See-also: https://lintian.debian.org/tags/upstream-metadata-file-is-missing.html
    Fixes: lintian: upstream-metadata-missing-bug-tracking
    See-also: https://lintian.debian.org/tags/upstream-metadata-missing-bug-tracking.html
    Fixes: lintian: upstream-metadata-missing-repository
    See-also: https://lintian.debian.org/tags/upstream-metadata-missing-repository.html

Created: 2021-09-07 Last update: 2022-01-25 03:06

3 low-priority security issues in buster low

There are 3 open security issues in buster.

3 issues left for the package maintainer to handle:

CVE-2020-19498: (needs triaging) Floating point exception in function Fraction in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impacts.
CVE-2020-19499: (needs triaging) An issue was discovered in heif::Box_iref::get_references in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impact due to an invalid memory read.
CVE-2020-23109: (needs triaging) Buffer overflow vulnerability in function convert_colorspace in heif_colorconversion.cc in libheif v1.6.2, allows attackers to cause a denial of service and disclose sensitive information, via a crafted HEIF file.

You can find information about how to handle these issues in the security team's documentation.

Created: 2021-07-26 Last update: 2021-12-09 11:34

1 low-priority security issue in bullseye low

There is 1 open security issue in bullseye.

1 issue left for the package maintainer to handle:

CVE-2020-23109: (needs triaging) Buffer overflow vulnerability in function convert_colorspace in heif_colorconversion.cc in libheif v1.6.2, allows attackers to cause a denial of service and disclose sensitive information, via a crafted HEIF file.

You can find information about how to handle this issue in the security team's documentation.

Created: 2021-11-03 Last update: 2021-12-09 11:34

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2019-07-07 Last update: 2019-07-07 20:06

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.6.0 instead of 4.5.1).

Created: 2021-08-18 Last update: 2021-09-01 07:35

news

[rss feed]

[2021-09-06] libheif 1.12.0-2 MIGRATED to testing (Debian testing watch)
[2021-08-31] Accepted libheif 1.12.0-2 (source) into unstable (Sebastian Ramacher)
[2021-06-08] Accepted libheif 1.12.0-1 (source) into experimental (Joachim Bauch) (signed by: Mattia Rizzolo)
[2021-02-11] libheif 1.11.0-1 MIGRATED to testing (Debian testing watch)
[2021-02-05] Accepted libheif 1.11.0-1 (source) into unstable (Joachim Bauch) (signed by: Sebastian Ramacher)
[2021-01-08] libheif 1.10.0-2 MIGRATED to testing (Debian testing watch)
[2021-01-08] libheif 1.10.0-2 MIGRATED to testing (Debian testing watch)
[2021-01-02] Accepted libheif 1.10.0-2 (source) into unstable (Sebastian Ramacher)
[2020-12-16] Accepted libheif 1.10.0-1 (source) into unstable (Joachim Bauch) (signed by: Sebastian Ramacher)
[2020-10-04] libheif 1.9.1-1 MIGRATED to testing (Debian testing watch)
[2020-09-28] Accepted libheif 1.9.1-1 (source) into unstable (Joachim Bauch) (signed by: Sebastian Ramacher)
[2020-09-02] libheif 1.8.0-1 MIGRATED to testing (Debian testing watch)
[2020-08-27] Accepted libheif 1.8.0-1 (source) into unstable (Joachim Bauch) (signed by: Sebastian Ramacher)
[2019-12-27] libheif 1.6.1-1 MIGRATED to testing (Debian testing watch)
[2019-12-21] Accepted libheif 1.6.1-1 (source) into unstable (Joachim Bauch) (signed by: Mattia Rizzolo)
[2019-11-15] libheif 1.6.0-1 MIGRATED to testing (Debian testing watch)
[2019-11-10] Accepted libheif 1.6.0-1 (source) into unstable (Joachim Bauch) (signed by: Sebastian Ramacher)
[2019-09-05] libheif 1.5.1-1 MIGRATED to testing (Debian testing watch)
[2019-08-31] Accepted libheif 1.5.1-1 (source) into unstable (Joachim Bauch) (signed by: Sebastian Ramacher)
[2019-08-23] libheif 1.5.0-1 MIGRATED to testing (Debian testing watch)
[2019-08-17] Accepted libheif 1.5.0-1 (source) into unstable (Joachim Bauch) (signed by: Mattia Rizzolo)
[2019-07-26] libheif 1.4.0-2 MIGRATED to testing (Debian testing watch)
[2019-07-07] Accepted libheif 1.4.0-2 (source) into unstable (Sebastian Ramacher)
[2019-06-09] libheif 1.3.2-2~deb10u1 MIGRATED to testing (Debian testing watch)
[2019-06-07] Accepted libheif 1.3.2-2~deb10u1 (source) into testing-proposed-updates (Salvatore Bonaccorso)
[2019-06-01] Accepted libheif 1.3.2-2 (source) into unstable (Reinhard Tartler)
[2019-04-03] Accepted libheif 1.4.0-1 (amd64 source) into experimental, experimental (Joachim Bauch) (signed by: Sebastian Ramacher)
[2018-06-27] libheif 1.3.2-1 MIGRATED to testing (Debian testing watch)
[2018-06-22] Accepted libheif 1.3.2-1 (source) into unstable (Joachim Bauch) (signed by: Sebastian Ramacher)
[2018-06-03] libheif 1.2.0-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 2
RC: 0
I&N: 1
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian (1, 0)
buildd: logs, checks, clang, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.12.0-2build1
1 bug