[ubuntu/resolute-updates] libheif 1.21.2-3ubuntu0.6 (Accepted)

[Ubuntu Archive Robot]

libheif (1.21.2-3ubuntu0.6) resolute-security; urgency=medium

  * SECURITY UPDATE: Denial of service in HEIF or AVIF metadata parsing
    - debian/patches/CVE-2026-84384-pre1.patch: add
      HeifFile::get_security_limits() getter in libheif/file.h
    - debian/patches/CVE-2026-84384-pre2.patch: catch C++ exceptions at the
      read/decode C API entry points in libheif/api_structs.h,
      libheif/error.h, ../error.cc, libheif/api/libheif/heif_context.cc,
      ../heif_decoding.cc, ../heif_sequences.cc and ../heif_tiling.cc
    - debian/patches/CVE-2026-84384.patch: bound brotli/zlib decompression
      output in libheif/compression.h, ../compression_brotli.cc,
      ../compression_zlib.cc, ../context.cc, ../file.cc,
      libheif/image-items/image_item.h,
      libheif/codecs/uncompressed/decoder_abstract.cc, and
      ../decoder_abstract.h
    - CVE-2026-84384
  * SECURITY UPDATE: Denial of service in HEIF parsing
    - debian/patches/CVE-2026-84446-pre1.patch: add calloc-style
      MemoryHandle::alloc() overload with integer-overflow checking in
      libheif/security_limits.cc and ../security_limits.h
    - debian/patches/CVE-2026-84446-pre2.patch: add
      heif_track_get_number_of_repetitions() API and supporting helpers in
      libheif/api/libheif/heif_sequences.h, ../heif_sequences.cc,
      libheif/context.cc, ../context.h, libheif/sequences/seq_boxes.h,
      ../track.cc and ../track.h
    - debian/patches/CVE-2026-84446.patch: Fix sequence timing-table DoS in
      libheif/api/libheif/heif_sequences.cc, libheif/sequences/chunk.cc,
      ../chunk.h, ../seq_boxes.cc, ../seq_boxes.h, ../track.cc and ../track.h
    - CVE-2026-84446
  * SECURITY UPDATE: Unbound allocation in reference graphs
    - debian/patches/CVE-2026-84447.patch: Bound derived-image reference
      amplification in libheif/context.cc, ../context.h, ../file.cc,
      ../file.h, libheif/image-items/grid.cc, ../grid.h, ../iden.cc,
      libheif/image-items/iden.h, ../image_item.cc, ../image_item.h,
      ../mask_image.cc, ../mask_image.h, ../overlay.cc, ../overlay.h,
      ../tiled.cc, ../tiled.h, ../unc_image.cc, ../unc_image.h,
      libheif/security_limits.h
    - CVE-2026-84447
  * SECURITY UPDATE: Denial of service in
    heif_region_item_add_region_inline_mask_data
    - debian/patches/CVE-2026-84448-pre1.patch: advance the parse offset after
      inline mask data in libheif/region.cc
    - debian/patches/CVE-2026-84448.patch: Validate inline mask data length
      in region writer API in libheif/api/libheif/heif_regions.cc and
      ../heif_regions.h
    - CVE-2026-84448

Date: 2026-09-28 20:29:13.001805+00:00
Changed-By: Kyle Kernick <kyle.kernick at canonical.com>
Signed-By: Ubuntu Archive Robot <ubuntu-archive-robot at lists.canonical.com>
https://launchpad.net/ubuntu/+source/libheif/1.21.2-3ubuntu0.6
-------------- next part --------------
Sorry, changesfile not available.