-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 09 Sep 2026 14:41:39 +0800 Source: libheif Architecture: source Version: 1.23.4-1~deb13u1 Distribution: trixie-security Urgency: high Maintainer: Debian Multimedia Maintainers Changed-By: Aron Xu Changes: libheif (1.23.4-1~deb13u1) trixie-security; urgency=high . * Non-maintainer upload by the Security Team. * New upstream release 1.23.4: - CVE-2026-84450: assertion failure in Fraction::Fraction when a "clap" box is combined with an oversized "ispe"; incomplete fix for GHSA-jc8f-p23p-5hjg. - CVE-2026-84451: out-of-bounds read; incomplete fix for GHSA-73p7-m7gg-w2jv. - CVE-2026-3949: out-of-bounds read in code, not enabled in Debian build. - GHSA-x8r2-mggj-j6wr: heap buffer overflow (write) in the uncompressed (unci) mixed-interleave decoder when the two chroma components declare different bit depths. - GHSA-w7mc-p8jc-p853: heap out-of-bounds read in the YCbCr 4:2:0 to 16-bit interleaved RGB colour conversion. - GHSA-4jqm-2x34-6f6r: heap buffer overflow in the SVT-AV1 encoder plugin when encoding a high-bit-depth alpha channel. - GHSA-9rj8-5mp5-26c9: out-of-bounds read in the RGB to YCbCr identity-matrix colour conversion. - GHSA-vg7w-rp49-4fc2: the max_items security limit was not enforced on "iinf" child boxes, "iref" reference entries were not capped, Box_iref references are now indexed by from_item_ID, and the Emscripten item-ID helpers no longer use alloca. - GHSA-5w8x-856j-7x7c: add_property() returned a property position belonging to another item. - GHSA-fqpw-fj22-78w4: encoder plugins did not validate the input image before encoding it. - GHSA-prgh-72vc-3xmc: cyclic decode reference graphs were not rejected before decoding. - GHSA-xrp2-63fq-jm8q: the decode-graph cycle check recursed without bound; it is now an explicit worklist. - GHSA-4rv4-953r-p24q: raw sequence sample leak and an unguarded C entry point. - GHSA-rhgw-q5g8-xjh2: coded/visible rectangle mismatch in the WebCodecs decoder plugin. * Do not build the heif-view tool so that the set of binary packages stays identical to the one trixie already ships. * d/control: Build libheif-plugin-kvazaar on all architectures again. Checksums-Sha1: 8c768cc496e429d07d17da27708379ff0fac421e 3377 libheif_1.23.4-1~deb13u1.dsc f8ab778f373973dcada7c77236d711e1310cc26a 2217221 libheif_1.23.4.orig.tar.gz 5b2ba1570b30816b0e1797aabf96fef6cd900ce3 15552 libheif_1.23.4-1~deb13u1.debian.tar.xz 84cc462f698110a28d1472055e5413c502e49df9 8087 libheif_1.23.4-1~deb13u1_source.buildinfo Checksums-Sha256: 6bf7fbd3de53ba819c770f07946e20123ed460f3d8eabe579f22218c96bf82c1 3377 libheif_1.23.4-1~deb13u1.dsc d0c02b4b0e978f34a1974b6f3eea7975a537bf7a9195ffeea38e7242ff316fdd 2217221 libheif_1.23.4.orig.tar.gz 5102677f6e7e98b9b80d19e7579617ae07fe56199e9c9ce91ce59c1e7a6e24aa 15552 libheif_1.23.4-1~deb13u1.debian.tar.xz 6c1ff0f1b2aa14ef18cd91dd467321c8e811a6d45a740f1e6fcdbe5479295e6c 8087 libheif_1.23.4-1~deb13u1_source.buildinfo Files: 5a484d0b96a267dac3d01561b5b7680d 3377 libs optional libheif_1.23.4-1~deb13u1.dsc 9cd6d40e19496a839dc9a7ba0b750f76 2217221 libs optional libheif_1.23.4.orig.tar.gz 2b2d426040be8e9a6f4f4e089f116d68 15552 libs optional libheif_1.23.4-1~deb13u1.debian.tar.xz 36cb0a96955b3a4671a6c08210b1be18 8087 libs optional libheif_1.23.4-1~deb13u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmq2UM0ACgkQ+GQ1dHE8 m674SAgAhjPkjVHYfIxLny1ckYoK9DqPBpfuw2XepwlQJtD6W9BlANzWTrtUODVr /C0xovUzh6YqJp18XlwUbWhphItYLsPvC4tFOzseygNwqb2UPQ+5FhvPRDbuTV5D q+/DnSgev8wNSi343QdDJ7kq6CEC6m9+5TpwidX58axbt9NvHKbRxgjztal1YtLK /BKHfMbNt5rMCTMwwB6jt0GnFsCl7nTOPLwrZoVJiGfJ3Zakp01VgVkROst+djKh l2FNRK0N/z0+k59QLVn5t94Yl84EWoSxBDgd8wmsL6L7FGj8tNFfQdQxLD1c4Ioi HHXOKei6oBulG8bzkVS4hN+6B9z3+Q== =V9Mp -----END PGP SIGNATURE-----