Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1179522 > unrolled thread

Bug#1059151: libheif: CVE-2023-49460 CVE-2023-49462 CVE-2023-49463 CVE-2023-49464

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#1059151: libheif: CVE-2023-49460 CVE-2023-49462 CVE-2023-49463 CVE-2023-49464 Moritz Mühlenhoff <jmm@inutil.org> - 2023-12-20 17:00 +0100

#1179522 — Bug#1059151: libheif: CVE-2023-49460 CVE-2023-49462 CVE-2023-49463 CVE-2023-49464

Source: libheif
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerabilities were published for libheif.

CVE-2023-49460[0]:
| libheif v1.17.5 was discovered to contain a segmentation violation
| via the function UncompressedImageCodec::decode_uncompressed_image.

https://github.com/strukturag/libheif/issues/1046
https://github.com/strukturag/libheif/commit/fd5b02aca3e29088bf0a1fc400bd661be4a6ed76

CVE-2023-49462[1]:
| libheif v1.17.5 was discovered to contain a segmentation violation
| via the component /libheif/exif.cc.

https://github.com/strukturag/libheif/issues/1043
https://github.com/strukturag/libheif/commit/730a9d80bea3434f75c79e721878cc67f3889969

CVE-2023-49463[2]:
| libheif v1.17.5 was discovered to contain a segmentation violation
| via the function find_exif_tag at /libheif/exif.cc.

https://github.com/strukturag/libheif/issues/1042
https://github.com/strukturag/libheif/commit/26ec3953d46bb5756b97955661565bcbc6647abf

CVE-2023-49464[3]:
| libheif v1.17.5 was discovered to contain a segmentation violation
| via the function UncompressedImageCodec::get_luma_bits_per_pixel_fro
| m_configuration_unci.

https://github.com/strukturag/libheif/issues/1044
https://github.com/strukturag/libheif/pull/1049
https://github.com/strukturag/libheif/commit/2bf226a300951e6897ee7267d0dd379ba5ad7287

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-49460
    https://www.cve.org/CVERecord?id=CVE-2023-49460
[1] https://security-tracker.debian.org/tracker/CVE-2023-49462
    https://www.cve.org/CVERecord?id=CVE-2023-49462
[2] https://security-tracker.debian.org/tracker/CVE-2023-49463
    https://www.cve.org/CVERecord?id=CVE-2023-49463
[3] https://security-tracker.debian.org/tracker/CVE-2023-49464
    https://www.cve.org/CVERecord?id=CVE-2023-49464

Please adjust the affected versions in the BTS as needed.

[toc] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web