[ubuntu/resolute-security] libheif 1.21.2-3ubuntu0.3 (Accepted)

[Kyle Kernick]

libheif (1.21.2-3ubuntu0.3) resolute-security; urgency=medium

  * SECURITY UPDATE: Heap Buffer Overflow in Track::get_next_sample_raw_data
    - debian/patches/CVE-2026-47254-1.patch: Validate stsc sample coverage
      in libheif/sequences/track.cc
    - debian/patches/CVE-2026-47254-2.patch: add defensive check in
      init_sample_timing_table() in libheif/sequences/track.cc
    - CVE-2026-47254
  * SECURITY UPDATE: Integer overflow when parsing uncC.
    - debian/patches/CVE-2026-47709-1.patch: Prevent integer overflow
      when parsing uncC in libheif/codecs/uncompressed/unc_boxes.cc
    - debian/patches/CVE-2026-47709-2.patch: Reject unci images with no ispe
      box in libheif/image-items/unc_image.cc
    - CVE-2026-47709
  * SECURITY UPDATE: Integer overflow in inline mask size calculation
    - debian/patches/CVE-2026-47714.patch: Fix computation of size of inline
      region mask in libheif/region.cc
    - CVE-2026-47714
  * SECURITY UPDATE: OOB read in ImageItem_Grid::decode_grid_tile.
    - debian/patches/CVE-2026-48029.patch: Fix tile coordinates validation
      in rotated images in libheif/api/libheif/heif_tiling.cc and
      libheif/image-items/image_item.cc
    - CVE-2026-48029
  * SECURITY UPDATE: Unbounded heap allocation in sequence parser.
    - debian/patches/CVE-2026-50142.patch: Fix check against security limit
      in libheif/sequences/seq_boxes.cc and ../track.cc
    - CVE-2026-50142

Date: 2026-07-07 20:09:36.839669+00:00
Changed-By: Kyle Kernick <kyle.kernick at canonical.com>
https://launchpad.net/ubuntu/+source/libheif/1.21.2-3ubuntu0.3
-------------- next part --------------
Sorry, changesfile not available.