-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-cfdbb8b2f0 2026-09-26 01:21:57.818480+00:00 --------------------------------------------------------------------------------
Name : libheif Product : Fedora 44 Version : 1.23.5 Release : 3.fc44 URL : https://github.com/strukturag/libheif Summary : HEIF and AVIF file format decoder and encoder Description : libheif is an ISO/IEC 23008-12:2017 HEIF and AVIF (AV1 Image File Format) file format decoder and encoder. -------------------------------------------------------------------------------- Update Information: Latest security bugfix release from upstream. Changes: https://github.com/strukturag/libheif/releases/tag/v1.23.5 . -------------------------------------------------------------------------------- ChangeLog: * Tue Sep 22 2026 Michel Lind <[email protected]> - 1.23.5-3 - Align the conditionals for codecs disabled on EL <= 9 * Tue Sep 22 2026 Michel Lind <[email protected]> - 1.23.5-2 - Remove patch already in 1.23.5 * Mon Sep 21 2026 Packit <[email protected]> - 1.23.5-1 - Update to 1.23.5 upstream release - Resolves: rhbz#2537580 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2426449 - CVE-2025-68431 libheif: libheif has Potential Heap Buffer Over-Read [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2426449 [ 2 ] Bug #2446924 - CVE-2026-3949 libheif: libheif: Out-of-bounds read via local argument manipulation [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2446924 [ 3 ] Bug #2489146 - CVE-2026-41069 libheif: libheif: Denial of Service via malformed HEIF sequence file [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2489146 [ 4 ] Bug #2494766 - CVE-2026-49271 libheif: libheif: Denial of Service via crafted HEIF file due to integer wrap-around [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2494766 [ 5 ] Bug #2506067 - CVE-2026-47251 libheif: libheif: Denial of Service and information disclosure via crafted HEIF file [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2506067 [ 6 ] Bug #2506070 - CVE-2026-47709 libheif: libheif: Denial of Service via malformed HEIF image [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2506070 [ 7 ] Bug #2506071 - CVE-2026-47714 libheif: libheif: Denial of service and information disclosure via integer overflow in inline mask parsing [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2506071 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-cfdbb8b2f0' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
