[Git][security-tracker-team/security-tracker][master] Track fixes for libheif via DSA-6583-1

Salvatore Bonaccorso (@carnil) carnil at debian.org
Sun Oct 25 19:59:37 GMT 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
3ee77cd9 by Salvatore Bonaccorso at 2026-10-25T20:58:24+01:00
Track fixes for libheif via DSA-6583-1

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -47223,63 +47223,74 @@ CVE-2026-93402 [mdtls discards the peer-identity verification result]
 	NOTE: Fixed by: https://github.com/rsyslog/rsyslog/commit/7847bd5392cb018646afc8f267aedfb5d51df1f9
 CVE-2026-XXXX [GHSA-8p2c-9wv4-rx4p: NULL pointer dereference in `Track_Visual::decode_next_image_sample()` when a sequence chunk references a non-visual sample entry]
 	- libheif 1.23.6-1
+	[trixie] - libheif 1.23.6-2~deb13u1
 	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-8p2c-9wv4-rx4p
 CVE-2026-XXXX [GHSA-fcmw-5764-7rq8: Decompressed `unci` tile data escapes the memory budget in the `cmpC` `image_tile` branch]
 	- libheif 1.23.6-1
+	[trixie] - libheif 1.23.6-2~deb13u1
 	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-fcmw-5764-7rq8
 CVE-2026-XXXX [GHSA-6fqc-p7r8-2g36: CPU amplification: a generically compressed `unci` item is decompressed once per tile]
 	- libheif 1.23.6-1
+	[trixie] - libheif 1.23.6-2~deb13u1
 	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-6fqc-p7r8-2g36
 CVE-2026-XXXX [GHSA-86ch-j429-fpr2: HEVC size limits can be skipped before decoding with the FFmpeg decoder plugin]
 	- libheif 1.23.6-1
+	[trixie] - libheif 1.23.6-2~deb13u1
 	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-86ch-j429-fpr2
 CVE-2026-XXXX [GHSA-vr5j-9r89-725x: CPU amplification in unci decode path surviving GHSA-24wx-9w62-c96w fix]
 	- libheif <unfixed>
 	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-vr5j-9r89-725x
 CVE-2026-XXXX [GHSA-hqpw-h8p6-22q9: Heap out-of-bounds read in the FFmpeg decoder plugin: input passed to av_parser_parse2() without padding]
 	- libheif 1.23.6-1
+	[trixie] - libheif 1.23.6-2~deb13u1
 	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-hqpw-h8p6-22q9
 CVE-2026-XXXX [GHSA-q7mw-2fmm-5q94: Out-of-bounds read in libsharpyuv through sample values above the image's bit depth]
 	- libheif 1.23.6-1
+	[trixie] - libheif 1.23.6-2~deb13u1
 	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-q7mw-2fmm-5q94
 CVE-2026-XXXX [GHSA-v5rj-g4wv-j5w3: Uncompressed codec returns chroma samples above the declared bit depth in mixed interleave mode]
 	- libheif 1.23.6-1
+	[trixie] - libheif 1.23.6-2~deb13u1
 	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-v5rj-g4wv-j5w3
 CVE-2026-XXXX [GHSA-3gwx-cjv4-jr74: Reachable assertion when decoding a grid image with an alpha plane of more than 16 bits]
 	- libheif 1.23.6-1
+	[trixie] - libheif 1.23.6-2~deb13u1
 	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-3gwx-cjv4-jr74
 CVE-2026-XXXX [GHSA-hvwh-xpj6-ph5x: Error message used after free in heif-enc input loaders]
 	- libheif 1.23.6-1
+	[trixie] - libheif 1.23.6-2~deb13u1
 	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-hvwh-xpj6-ph5x
 CVE-2026-XXXX [GHSA-vv35-6hxg-95x8: Decoded image can have another bit depth than the image handle reports]
 	- libheif 1.23.6-1
+	[trixie] - libheif 1.23.6-2~deb13u1
 	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-vv35-6hxg-95x8
 CVE-2026-XXXX [GHSA-h4h8-qgvc-m7r2: OpenJPEG decoder: tile and component counts of a JPEG 2000 codestream cause allocations of several gigabytes regardless of the security limits]
 	- libheif 1.23.6-1
+	[trixie] - libheif 1.23.6-2~deb13u1
 	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-h4h8-qgvc-m7r2
 CVE-2026-XXXX [GHSA-v8qw-hwjv-44hw: AV1/libaom path allows allocation before libheif rejects mismatched coded dimensions]
 	- libheif 1.23.6-1
-	[trixie] - libheif <no-dsa> (Minor issue)
+	[trixie] - libheif 1.23.6-2~deb13u1
 	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-v8qw-hwjv-44hw
 CVE-2026-XXXX [GHSA-qfj5-c4pq-q998: Out-of-bounds heap read in unc_encoder_rgb_pixel_interleave when an alpha plane is attached to an image whose chroma format carries no alpha]
 	- libheif 1.23.6-1
-	[trixie] - libheif <no-dsa> (Minor issue)
+	[trixie] - libheif 1.23.6-2~deb13u1
 	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-qfj5-c4pq-q998
 CVE-2026-XXXX [GHSA-qwpf-5wf7-r996: Heap-use-after-free and double free in ImageItem::encode_to_bitstream_and_boxes (shallow copy of ImageDescription::m_tai_timestamp)]
 	- libheif 1.23.6-1
-	[trixie] - libheif <no-dsa> (Minor issue)
+	[trixie] - libheif 1.23.6-2~deb13u1
 	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-qwpf-5wf7-r996
 CVE-2026-XXXX [GHSA-9c75-9g8r-4728: JPEG 2000 pclr zero-column allocation amplification bypasses max_total_memory]
 	- libheif 1.23.6-1
-	[trixie] - libheif <no-dsa> (Minor issue)
+	[trixie] - libheif 1.23.6-2~deb13u1
 	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-9c75-9g8r-4728
 CVE-2026-XXXX [GHSA-r7gr-2xm2-23wf: Heap out-of-bounds read in libheif alpha compositing via mismatched per-channel bit depths (uncompressed codec)]
 	- libheif 1.23.6-1
-	[trixie] - libheif <no-dsa> (Minor issue)
+	[trixie] - libheif 1.23.6-2~deb13u1
 	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-r7gr-2xm2-23wf
 CVE-2026-XXXX [GHSA-7pwf-qh74-p35w: Caller-configured security limits not enforced for MINI-box parsing]
 	- libheif 1.23.6-1
-	[trixie] - libheif <no-dsa> (Minor issue)
+	[trixie] - libheif 1.23.6-2~deb13u1
 	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-7pwf-qh74-p35w
 CVE-2026-111374 (FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulne ...)
 	- freerdp3 3.32.0+dfsg-1



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3ee77cd96316292696c6199cb69cf62405fbf787

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3ee77cd96316292696c6199cb69cf62405fbf787
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261025/cc0cecac/attachment.htm>

More information about the debian-security-tracker-commits mailing list