From 0fe2d74ffd1290422d0fb721481f4acd60d12cc0 Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Sat, 29 Aug 2026 20:09:30 +0200 Subject: [PATCH] package/libheif: security bump version to 1.23.2 https://github.com/strukturag/libheif/releases/tag/v1.23.2 Fixes the following CVEs: (CVE numbers will be added upstream when assigned.) CVE-2026-XXXXX (GHSA-g89c-p67h-r497) Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha planes from nested iden/auxl items. (critical) (GHSA-2jg2-4ch7-h545) Out-of-bounds read and write in derived-item and pixel-plane handling. Through iden and auxl item chains, a crafted file could attach pixel planes whose size differs from the image geometry; crop, scale, and plane-extraction code then indexed those planes with the wrong size. A working code-execution exploit was confirmed. Plane sizes are now validated wherever they are consumed. (critical) CVE-2026-XXXXX (GHSA-24wx-9w62-c96w) brotli/zlib decompression of mime metadata and unci image data had no effective output-size limit, so a decompression bomb could exhaust memory. Decompressed output is now bounded by the security limits. (high) CVE-2026-XXXXX (GHSA-x8xm-cm2c-cfc8) Chains of derived-image references (grid, iovl, iden) bypassed decode caching and memory limits, causing CPU and memory amplification. (high) CVE-2026-XXXXX (GHSA-xw34-mjcp-jqh8) Sequence sample-timing initialization could produce non-terminating decode loops and unbounded memory, bypassing max_sequence_frames. (high) CVE-2026-XXXXX (GHSA-j264-xvrp-5v7q) Out-of-bounds write in the unci encoder when heif_context_add_image_tile() is given a tile whose planes do not match its declared size. (high) CVE-2026-XXXXX (GHSA-p58j-h3vm-3fp5) Heap out-of-bounds read in the inline-mask region API when mask_data_len does not match the region geometry. (medium) Signed-off-by: Bernd Kuhls Signed-off-by: Peter Korsgaard --- package/libheif/libheif.hash | 4 ++-- package/libheif/libheif.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/libheif/libheif.hash b/package/libheif/libheif.hash index ff8c05c7e4..31fe79b16e 100644 --- a/package/libheif/libheif.hash +++ b/package/libheif/libheif.hash @@ -1,4 +1,4 @@ -# From https://github.com/strukturag/libheif/releases/tag/v1.23.1 -sha256 0de0327f60fcd47de90d5654c6fe152232738d60d84fe084ec3e0f35e03b166a libheif-1.23.1.tar.gz +# From https://github.com/strukturag/libheif/releases/tag/v1.23.2 +sha256 8bd5d41d19dc84536d118b04774709f244df6104ef66d623dad5fa4650143405 libheif-1.23.2.tar.gz # Locally computed: sha256 fa81ce652315b013359d6e8e4744335f31a50c7c192907176d3632f78a3b4596 COPYING diff --git a/package/libheif/libheif.mk b/package/libheif/libheif.mk index 124dba7c24..755a9909c4 100644 --- a/package/libheif/libheif.mk +++ b/package/libheif/libheif.mk @@ -4,7 +4,7 @@ # ################################################################################ -LIBHEIF_VERSION = 1.23.1 +LIBHEIF_VERSION = 1.23.2 LIBHEIF_SITE = https://github.com/strukturag/libheif/releases/download/v$(LIBHEIF_VERSION) LIBHEIF_LICENSE = LGPL-3.0+ LIBHEIF_LICENSE_FILES = COPYING