mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-09 07:51:59 -09:00
d148168e20
https://github.com/strukturag/libheif/releases/tag/v1.23.3 Fixes the following CVEs: (CVE numbers will be added when assigned.) CVE-2026-XXXXX (GHSA-x8r2-mggj-j6wr) Heap buffer overflow (write) in the uncompressed (unci) mixed-interleave decoder when the two chroma components declare different bit depths. Both the written bytes and the overflow length are controlled by the file. (critical) CVE-2026-XXXXX (GHSA-8fmq-r4pf-7m57) Permanent decoder deadlock through a reference cycle between an image and its alpha auxiliary image. The alpha edge was not covered by the cycle guard and re-entered a held mutex. (high) CVE-2026-XXXXX (GHSA-w7mc-p8jc-p853) Heap out-of-bounds read in the YCbCr 4:2:0 to 16-bit interleaved RGB conversion when the chroma planes have a lower bit depth than luma. Heap memory could end up in the decoded image. YCbCr conversions with mismatched luma and chroma bit depths are now rejected. (high) CVE-2026-XXXXX (GHSA-4jqm-2x34-6f6r) Heap buffer overflow in the SVT-AV1 encoder plugin when encoding a high-bit-depth alpha channel, and a double free on its send-picture error path. (high) CVE-2026-84451 (GHSA-hh47-fhqr-cj2r) Incomplete fix for GHSA-73p7-m7gg-w2jv: the tile range check of the unci decoder (without icef) could still overflow, allowing an out-of-bounds read. (medium) CVE-2026-XXXXX (GHSA-4h82-g446-83fm) Heap out-of-bounds read when converting odd-height 4:2:0 frames of an uncompressed (uncv) image sequence to RGB. (medium) CVE-2026-XXXXX (GHSA-9rj8-5mp5-26c9) Out-of-bounds read in the RGB to YCbCr identity-matrix color conversion when the R, G, and B planes have different bit depths. (medium) CVE-2026-84450 (GHSA-gh5q-69gg-c964) A clap property combined with an oversized ispe reached an assert() in the Fraction arithmetic and aborted the process (incomplete fix for GHSA-jc8f-p23p-5hjg). An error is returned instead. (medium) (GHSA-mw6f-29j3-76f4) Several smaller findings: heif_image_handle_get_depth_image_handle() and heif_image_handle_get_depth_image_representation_info() dereferenced a null pointer on files without a depth image; the TIFF input decoder of the example tools had an unbounded EXIF tag allocation and a division by zero on zero YCbCr subsampling; assert()s in the PNG input decoder are now error returns; integer overflow in the Go binding's ImageAccess.GetPlane(); heif-view now verifies the decoded frame size before display. (medium) (GHSA-8857-r8x5-7499) Undefined behavior (negative shift) in the HDR bit-depth up-conversion for target bit depths above 16. Such conversions are now rejected. (low) Signed-off-by: Bernd Kuhls <bernd@kuhls.net> Signed-off-by: Julien Olivain <ju.o@free.fr>
5 lines
264 B
Plaintext
5 lines
264 B
Plaintext
# From https://github.com/strukturag/libheif/releases/tag/v1.23.3
|
|
sha256 11c1179e0e4bec33624b87f22ec42c1e993a40d946d44d26f9c431cf1456a863 libheif-1.23.3.tar.gz
|
|
# Locally computed:
|
|
sha256 fa81ce652315b013359d6e8e4744335f31a50c7c192907176d3632f78a3b4596 COPYING
|