Ubuntu Security Notice 6847-1 - It was discovered that libheif incorrectly handled certain image data. An attacker could possibly use this issue to crash the program, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS. Reza Mirzazade Farkhani discovered that libheif incorrectly handled certain image data. An attacker could possibly use this issue to crash the program, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS.
98860e4bce3c2183b125bf0e0c52708c238fee73e10418bc4a9ca6250468c2a8
==========================================================================
Ubuntu Security Notice USN-6847-1
June 25, 2024
libheif vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
libheif could be made to crash if it opened a specially crafted
file.
Software Description:
- libheif: ISO/IEC 23008-12:2017 HEIF file format decoder - development file
Details:
It was discovered that libheif incorrectly handled certain image data.
An attacker could possibly use this issue to crash the program, resulting
in a denial of service. This issue only affected Ubuntu 18.04 LTS.
(CVE-2019-11471)
Reza Mirzazade Farkhani discovered that libheif incorrectly handled
certain image data. An attacker could possibly use this issue to crash the
program, resulting in a denial of service. This issue only affected Ubuntu
20.04 LTS. (CVE-2020-23109)
Eugene Lim discovered that libheif incorrectly handled certain image data.
An attacker could possibly use this issue to crash the program, resulting
in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu
20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-0996)
Min Jang discovered that libheif incorrectly handled certain image data.
An attacker could possibly use this issue to crash the program, resulting
in a denial of service. This issue only affected Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2023-29659)
Yuchuan Meng discovered that libheif incorrectly handled certain image data.
An attacker could possibly use this issue to crash the program, resulting
in a denial of service. This issue only affected Ubuntu 23.10.
(CVE-2023-49460, CVE-2023-49462, CVE-2023-49463, CVE-2023-49464)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10
heif-gdk-pixbuf 1.16.2-2ubuntu1.1
libheif-dev 1.16.2-2ubuntu1.1
libheif-plugin-libde265 1.16.2-2ubuntu1.1
libheif1 1.16.2-2ubuntu1.1
Ubuntu 22.04 LTS
heif-gdk-pixbuf 1.12.0-2ubuntu0.1~esm1
Available with Ubuntu Pro
libheif-dev 1.12.0-2ubuntu0.1~esm1
Available with Ubuntu Pro
libheif1 1.12.0-2ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 20.04 LTS
heif-gdk-pixbuf 1.6.1-1ubuntu0.1~esm1
Available with Ubuntu Pro
libheif-dev 1.6.1-1ubuntu0.1~esm1
Available with Ubuntu Pro
libheif1 1.6.1-1ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 18.04 LTS
libheif-dev 1.1.0-2ubuntu0.1~esm1
Available with Ubuntu Pro
libheif1 1.1.0-2ubuntu0.1~esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6847-1
CVE-2019-11471, CVE-2020-23109, CVE-2023-0996, CVE-2023-29659,
CVE-2023-49460, CVE-2023-49462, CVE-2023-49463, CVE-2023-49464
Package Information:
https://launchpad.net/ubuntu/+source/libheif/1.16.2-2ubuntu1.1