Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
1aa0ee61 by Salvatore Bonaccorso at 2026-10-11T11:43:29+02:00
Add new batch of libheif issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -21800,6 +21800,42 @@ CVE-2026-93402 [mdtls discards the peer-identity
verification result]
NOTE: https://github.com/rsyslog/rsyslog/pull/7617
NOTE: Fixed by:
https://github.com/rsyslog/rsyslog/commit/ef9f77d709640ceb3d5e78118081a291f9e373c5
NOTE: Fixed by:
https://github.com/rsyslog/rsyslog/commit/7847bd5392cb018646afc8f267aedfb5d51df1f9
+CVE-2026-XXXX [GHSA-8p2c-9wv4-rx4p: NULL pointer dereference in
`Track_Visual::decode_next_image_sample()` when a sequence chunk references a
non-visual sample entry]
+ - libheif 1.23.6-1
+ NOTE:
https://github.com/strukturag/libheif/security/advisories/GHSA-8p2c-9wv4-rx4p
+CVE-2026-XXXX [GHSA-fcmw-5764-7rq8: Decompressed `unci` tile data escapes the
memory budget in the `cmpC` `image_tile` branch]
+ - libheif 1.23.6-1
+ NOTE:
https://github.com/strukturag/libheif/security/advisories/GHSA-fcmw-5764-7rq8
+CVE-2026-XXXX [GHSA-6fqc-p7r8-2g36: CPU amplification: a generically
compressed `unci` item is decompressed once per tile]
+ - libheif 1.23.6-1
+ NOTE:
https://github.com/strukturag/libheif/security/advisories/GHSA-6fqc-p7r8-2g36
+CVE-2026-XXXX [GHSA-86ch-j429-fpr2: HEVC size limits can be skipped before
decoding with the FFmpeg decoder plugin]
+ - libheif 1.23.6-1
+ NOTE:
https://github.com/strukturag/libheif/security/advisories/GHSA-86ch-j429-fpr2
+CVE-2026-XXXX [GHSA-vr5j-9r89-725x: CPU amplification in unci decode path
surviving GHSA-24wx-9w62-c96w fix]
+ - libheif <unfixed>
+ NOTE:
https://github.com/strukturag/libheif/security/advisories/GHSA-vr5j-9r89-725x
+CVE-2026-XXXX [GHSA-hqpw-h8p6-22q9: Heap out-of-bounds read in the FFmpeg
decoder plugin: input passed to av_parser_parse2() without padding]
+ - libheif 1.23.6-1
+ NOTE:
https://github.com/strukturag/libheif/security/advisories/GHSA-hqpw-h8p6-22q9
+CVE-2026-XXXX [GHSA-q7mw-2fmm-5q94: Out-of-bounds read in libsharpyuv through
sample values above the image's bit depth]
+ - libheif 1.23.6-1
+ NOTE:
https://github.com/strukturag/libheif/security/advisories/GHSA-q7mw-2fmm-5q94
+CVE-2026-XXXX [GHSA-v5rj-g4wv-j5w3: Uncompressed codec returns chroma samples
above the declared bit depth in mixed interleave mode]
+ - libheif 1.23.6-1
+ NOTE:
https://github.com/strukturag/libheif/security/advisories/GHSA-v5rj-g4wv-j5w3
+CVE-2026-XXXX [GHSA-3gwx-cjv4-jr74: Reachable assertion when decoding a grid
image with an alpha plane of more than 16 bits]
+ - libheif 1.23.6-1
+ NOTE:
https://github.com/strukturag/libheif/security/advisories/GHSA-3gwx-cjv4-jr74
+CVE-2026-XXXX [GHSA-hvwh-xpj6-ph5x: Error message used after free in heif-enc
input loaders]
+ - libheif 1.23.6-1
+ NOTE:
https://github.com/strukturag/libheif/security/advisories/GHSA-hvwh-xpj6-ph5x
+CVE-2026-XXXX [GHSA-vv35-6hxg-95x8: Decoded image can have another bit depth
than the image handle reports]
+ - libheif 1.23.6-1
+ NOTE:
https://github.com/strukturag/libheif/security/advisories/GHSA-vv35-6hxg-95x8
+CVE-2026-XXXX [GHSA-h4h8-qgvc-m7r2: OpenJPEG decoder: tile and component
counts of a JPEG 2000 codestream cause allocations of several gigabytes
regardless of the security limits]
+ - libheif 1.23.6-1
+ NOTE:
https://github.com/strukturag/libheif/security/advisories/GHSA-h4h8-qgvc-m7r2
CVE-2026-XXXX [GHSA-v8qw-hwjv-44hw: AV1/libaom path allows allocation before
libheif rejects mismatched coded dimensions]
- libheif 1.23.6-1
[trixie] - libheif <no-dsa> (Minor issue)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1aa0ee6163faa98cdff1fa1bb6442e2c04207a02
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1aa0ee6163faa98cdff1fa1bb6442e2c04207a02
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
