-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-022ff83e3e 2026-09-26 01:29:25.124198+00:00 --------------------------------------------------------------------------------
Name : libheif Product : Fedora 43 Version : 1.23.5 Release : 3.fc43 URL : https://github.com/strukturag/libheif Summary : HEIF and AVIF file format decoder and encoder Description : libheif is an ISO/IEC 23008-12:2017 HEIF and AVIF (AV1 Image File Format) file format decoder and encoder. -------------------------------------------------------------------------------- Update Information: Latest security bugfix release from upstream. Changes: https://github.com/strukturag/libheif/releases/tag/v1.23.5 . -------------------------------------------------------------------------------- ChangeLog: * Tue Sep 22 2026 Michel Lind <[email protected]> - 1.23.5-3 - Align the conditionals for codecs disabled on EL <= 9 * Tue Sep 22 2026 Michel Lind <[email protected]> - 1.23.5-2 - Remove patch already in 1.23.5 * Mon Sep 21 2026 Packit <[email protected]> - 1.23.5-1 - Update to 1.23.5 upstream release - Resolves: rhbz#2537580 * Thu Sep 17 2026 Dominik 'Rathann' Mierzejewski <[email protected]> - 1.23.4-6 - Rebuilt for FFmpeg 9 * Tue Sep 15 2026 Dominik 'Rathann' Mierzejewski <[email protected]> - 1.23.4-5 - add Conflicts+Obsoletes to the FFmpeg plugin * Tue Sep 15 2026 Dominik 'Rathann' Mierzejewski <[email protected]> - 1.23.4-4 - split the FFmpeg plugin into a subpackage (resolves rhbz#2532713) * Tue Sep 15 2026 MiloÅ¡ KomarÄeviÄ <[email protected]> - 1.23.4-3 - Clean up build options * Tue Sep 15 2026 Dominik 'Rathann' Mierzejewski <[email protected]> - 1.23.4-2 - drop upstreamed patch * Sun Sep 6 2026 Packit <[email protected]> - 1.23.4-1 - Update to 1.23.4 upstream release - Resolves: rhbz#2529208 * Fri Sep 4 2026 Dominik 'Rathann' Mierzejewski <[email protected]> - 1.23.3-4 - Rebuilt for FFmpeg 9 * Thu Sep 3 2026 Dominik 'Rathann' Mierzejewski <[email protected]> - 1.23.3-3 - Rebuilt for FFmpeg 9 * Wed Sep 2 2026 Dominik 'Rathann' Mierzejewski <[email protected]> - 1.23.3-2 - skip certain tests when HEVC codec is unavailable * Wed Sep 2 2026 Packit <[email protected]> - 1.23.3-1 - Update to 1.23.3 upstream release - Resolves: rhbz#2523409 * Mon Aug 10 2026 Simone Caronni <[email protected]> - 1.23.1-9 - Fix condition * Mon Aug 10 2026 Simone Caronni <[email protected]> - 1.23.1-8 - Disable bootstrap * Mon Aug 10 2026 Simone Caronni <[email protected]> - 1.23.1-7 - Gate openh264 plugin for i386 * Mon Aug 10 2026 Simone Caronni <[email protected]> - 1.23.1-6 - Enable standalone openh264 plugin * Sun Aug 9 2026 Simone Caronni <[email protected]> - 1.23.1-5 - Add FFMpeg plugin file to bootstrap exclusion * Sun Aug 9 2026 Simone Caronni <[email protected]> - 1.23.1-4 - Also add libavcodec BR to bootstrap exclusion * Sun Aug 9 2026 Simone Caronni <[email protected]> - 1.23.1-3 - Add FFMpeg plugin to bootstrap exclusion * Sun Aug 9 2026 Simone Caronni <[email protected]> - 1.23.1-2 - Enable standalone plugins including FFMpeg * Sun Aug 9 2026 Simone Caronni <[email protected]> - 1.23.1-1 - Update to 1.23.1, make PLUGIN_DIRECTORY private * Thu Jul 16 2026 Fedora Release Engineering <[email protected]> - 1.21.2-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild * Wed Jun 17 2026 Simone Caronni <[email protected]> - 1.21.2-7 - Finish bootstrap (openjph update) * Wed Jun 17 2026 Simone Caronni <[email protected]> - 1.21.2-6 - Enable bootstrap (openjph update) * Sat May 2 2026 Simone Caronni <[email protected]> - 1.21.2-5 - Finish bootstrap (openjph update) * Sat May 2 2026 Simone Caronni <[email protected]> - 1.21.2-4 - Enable bootstrap (openjph update) * Wed Feb 18 2026 Simone Caronni <[email protected]> - 1.21.2-3 - Disable bootstrap for OpenJPH update * Wed Feb 18 2026 Simone Caronni <[email protected]> - 1.21.2-2 - Enable bootstrap for OpenJPH update * Fri Jan 16 2026 Packit <[email protected]> - 1.21.2-1 - Update to 1.21.2 upstream release - Resolves: rhbz#2430343 * Fri Jan 16 2026 MiloÅ¡ KomarÄeviÄ <[email protected]> - 1.21.1-2 - Enable OpenJPH in i686 builds for real * Fri Jan 2 2026 Dominik 'Rathann' Mierzejewski <[email protected]> - 1.21.1-1 - update to 1.21.1 (rhbz#2425867) - enable TIFF support - enable AOM explicitly * Thu Nov 27 2025 Simone Caronni <[email protected]> - 1.20.2-10 - Finish bootstrap (openjph update) * Thu Nov 27 2025 Simone Caronni <[email protected]> - 1.20.2-9 - Enable bootstrap (openjph update) * Thu Nov 27 2025 Simone Caronni <[email protected]> - 1.20.2-8 - OpenJPH is available also on i686 * Thu Nov 27 2025 Simone Caronni <[email protected]> - 1.20.2-7 - Drop no longer relevant comment -------------------------------------------------------------------------------- References: [ 1 ] Bug #2426449 - CVE-2025-68431 libheif: libheif has Potential Heap Buffer Over-Read [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2426449 [ 2 ] Bug #2446924 - CVE-2026-3949 libheif: libheif: Out-of-bounds read via local argument manipulation [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2446924 [ 3 ] Bug #2489146 - CVE-2026-41069 libheif: libheif: Denial of Service via malformed HEIF sequence file [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2489146 [ 4 ] Bug #2494766 - CVE-2026-49271 libheif: libheif: Denial of Service via crafted HEIF file due to integer wrap-around [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2494766 [ 5 ] Bug #2506067 - CVE-2026-47251 libheif: libheif: Denial of Service and information disclosure via crafted HEIF file [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2506067 [ 6 ] Bug #2506070 - CVE-2026-47709 libheif: libheif: Denial of Service via malformed HEIF image [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2506070 [ 7 ] Bug #2506071 - CVE-2026-47714 libheif: libheif: Denial of service and information disclosure via integer overflow in inline mask parsing [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2506071 [ 8 ] Bug #2539257 - CVE-2026-84384 libheif: libheif: Denial of Service due to unbounded memory consumption via crafted HEIF/AVIF files [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2539257 [ 9 ] Bug #2539259 - CVE-2026-84444 libheif: libheif: Out-of-bounds write allows arbitrary code execution via crafted image tile [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2539259 [ 10 ] Bug #2539261 - CVE-2026-84446 libheif: libheif: Denial of Service via crafted HEIF sequence timing data [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2539261 [ 11 ] Bug #2539264 - CVE-2026-84447 libheif: libheif: Denial of Service via crafted HEIF/AVIF image files [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2539264 [ 12 ] Bug #2539266 - CVE-2026-84448 libheif: libheif: Information disclosure and denial of service due to heap out-of-bounds read [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2539266 [ 13 ] Bug #2539269 - CVE-2026-84450 libheif: libheif: Denial of Service due to integer overflow in image processing [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2539269 [ 14 ] Bug #2539271 - CVE-2026-84451 libheif: libheif: Denial of Service due to out-of-bounds read in image tile processing [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2539271 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-022ff83e3e' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------
-- _______________________________________________ package-announce mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
