Accepted libheif 1.23.6-1 (source) into unstable

Debian FTP Masters Sat, 10 Oct 2026 14:52:54 -0700
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sat, 10 Oct 2026 23:24:21 +0200
Source: libheif
Built-For-Profiles: noudeb
Architecture: source
Version: 1.23.6-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Multimedia Maintainers <[email protected]>
Changed-By: Joachim Bauch <[email protected]>
Changes:
 libheif (1.23.6-1) unstable; urgency=medium
 .
   * New upstream version 1.23.6
   * Various security fixes:
     - Fixes memory exhaustion through container and bitstream image size
       mismatch. See upstream commit 6ce2bba (GHSA-v8qw-hwjv-44hw).
     - Fixes heap use-after-free and double free when encoding image with
       TAI timestamp. See upstream commit 45a40ca (GHSA-qwpf-5wf7-r996).
     - Fixes memory amplification through a JPEG 2000 pclr box. See
       upstream commit ba47ddd (GHSA-9c75-9g8r-4728).
     - Fixes heap out-of-bounds read in alpha compositing for uncompressed
       (unci) images. See upstream commits e379fd5 and 6f58ba3
       (GHSA-r7gr-2xm2-23wf).
     - Fixes incomplete OpenJPEG pre-decode security limits allowing
       unsafe decode through the public API.
       See upstream commit a44ad89 (GHSA-q492-cfcm-895h).
     - Fixes heap out-of-bounds read in the uncompressed encode.
       See upstream commit c727622 (GHSA-qfj5-c4pq-q998).
     - Fixes applying heif_security_limits when parsing a mini box or the
       av1C/hvcC blob embedded in it.
       See upstream commit 24219cb (GHSA-7pwf-qh74-p35w).
   * Unpackaged upstream version 1.23.5 contains the following security
     fixes:
     - Fixes enforcing max_items security limit for the child boxes of iinf.
       See upstream commits 2ebb06f, 19fd108, eb339b7 and 92b79c6
       (GHSA-vg7w-rp49-4fc2).
     - Fixes unbounded iref entry list and unbounded recursion in the
       reference-cycle check.
       See upstream commits b1e4d72 and 7538a4f (GHSA-xrp2-63fq-jm8q).
     - Fixes permanent decoder deadlock through a lock-order inversion in
       parallel grid tile decoding. See upstream commit f8beb40
       (GHSA-prgh-72vc-3xmc).
     - Fixes heap out-of-bounds read in the encoder plugins. See upstream
       commit 51360e1 (GHSA-fqpw-fj22-78w4).
     - Fixes unreclaimable memory leak in
       heif_track_get_next_raw_sequence_sample.
       See upstream commit 3d9c246 (GHSA-4rv4-953r-p24q).
     - Fixes heap out-of-bounds read in the WebCodecs decoder plugin.
       See upstream commits fb8d945 and 604d837 (GHSA-rhgw-q5g8-xjh2).
   * Enable kvazaar plugin on loong64 now that #1127385 is resolved.
Checksums-Sha1:
 babab42c80e8ab9f4e5fd94de1da473a09a7e043 3736 libheif_1.23.6-1.dsc
 092204a0715469ee0f84134c9db3e86375dec587 2373898 libheif_1.23.6.orig.tar.gz
 39015927f6410eb88f1df31c6d85636d585faf74 15720 libheif_1.23.6-1.debian.tar.xz
 1347c49239d2a5f1d10ad5dfef27972bfe955048 16110 
libheif_1.23.6-1_source.buildinfo
Checksums-Sha256:
 8ef81773365fef1bb4635e20ccd5dac2f5f56c0f3f28a8e02ff99b794d731155 3736 
libheif_1.23.6-1.dsc
 4484346dc5995319dbc11e3a1c35d0a2ec46511ce370900869337fd2c7033125 2373898 
libheif_1.23.6.orig.tar.gz
 fb03abbbdf48fe36891d7baa9abb5b43f947a9b9fe6880381f2368cbc76f0668 15720 
libheif_1.23.6-1.debian.tar.xz
 60141564fd55f72bca964910513b5d2b6f1ae9d7460d1947f888e712363b677e 16110 
libheif_1.23.6-1_source.buildinfo
Files:
 1cb1ad01f80ddbf4038d29f78b9f7b85 3736 libs - libheif_1.23.6-1.dsc
 1e95c96fc0d3b8c40023b4b1a7184dab 2373898 libs - libheif_1.23.6.orig.tar.gz
 d1fd05b4c92f2e627edcb657eefdd7d1 15720 libs - libheif_1.23.6-1.debian.tar.xz
 8ee08a4ca24467102937bd3368fcd5dd 16110 libs - libheif_1.23.6-1_source.buildinfo
pgpasuNL3GakO.pgp
Description: PGP signature
Accepted libheif 1.23.6-1 (source) into unstable

Reply via email to
