* [Buildroot] [PATCH 1/1] package/libheif: security bump version to 1.23.1
@ 2026-07-24 17:21 Bernd Kuhls
2026-07-25 9:46 ` Julien Olivain via buildroot
2026-07-31 12:22 ` Thomas Perale via buildroot
0 siblings, 2 replies; 3+ messages in thread
From: Bernd Kuhls @ 2026-07-24 17:21 UTC (permalink / raw)
To: buildroot
https://github.com/strukturag/libheif/releases/tag/v1.23.1
Fixes the following CVEs:
CVE-2026-62289 (GHSA-jc8f-p23p-5hjg)
Integer underflow in Fraction constructor via double clap transform
application
CVE-2026-62291 (GHSA-xpw3-9rhw-482x)
Heap out of bounds write in libheif uncompressed encoder when writing
images with mismatched auxiliary alpha dimensions
CVE-2026-62292 (GHSA-73p7-m7gg-w2jv)
Out-of-bounds read in uncompressed unci tile range slicing
CVE-2026-62377 (GHSA-9ww4-9v47-m7pj)
Reachable assertion in HeifContext::get_track() aborts on a valid-but-
empty HEIF sequence file
(GHSA-46rp-pcq2-rpmr)
Heap out-of-bounds write in the uncompressed encoder for RRGGBB images
with interleaved bit-depth ≤ 8
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
Gitlab pipelines passed:
https://gitlab.com/bkuhls/buildroot/-/commits/a3d9028ad1a824e62d3a0a573ceca7c79addeebd
package/libheif/libheif.hash | 4 ++--
package/libheif/libheif.mk | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/package/libheif/libheif.hash b/package/libheif/libheif.hash
index 780059facf..ff8c05c7e4 100644
--- a/package/libheif/libheif.hash
+++ b/package/libheif/libheif.hash
@@ -1,4 +1,4 @@
-# From https://github.com/strukturag/libheif/releases/tag/v1.23.0
-sha256 4c9182b18897617182eed12ab5eb9f9d855b3aa3a736d6bdb31abc034ec7d393 libheif-1.23.0.tar.gz
+# From https://github.com/strukturag/libheif/releases/tag/v1.23.1
+sha256 0de0327f60fcd47de90d5654c6fe152232738d60d84fe084ec3e0f35e03b166a libheif-1.23.1.tar.gz
# Locally computed:
sha256 fa81ce652315b013359d6e8e4744335f31a50c7c192907176d3632f78a3b4596 COPYING
diff --git a/package/libheif/libheif.mk b/package/libheif/libheif.mk
index be97b18bd0..124dba7c24 100644
--- a/package/libheif/libheif.mk
+++ b/package/libheif/libheif.mk
@@ -4,7 +4,7 @@
#
################################################################################
-LIBHEIF_VERSION = 1.23.0
+LIBHEIF_VERSION = 1.23.1
LIBHEIF_SITE = https://github.com/strukturag/libheif/releases/download/v$(LIBHEIF_VERSION)
LIBHEIF_LICENSE = LGPL-3.0+
LIBHEIF_LICENSE_FILES = COPYING
--
2.47.3
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [Buildroot] [PATCH 1/1] package/libheif: security bump version to 1.23.1
2026-07-24 17:21 [Buildroot] [PATCH 1/1] package/libheif: security bump version to 1.23.1 Bernd Kuhls
@ 2026-07-25 9:46 ` Julien Olivain via buildroot
2026-07-31 12:22 ` Thomas Perale via buildroot
1 sibling, 0 replies; 3+ messages in thread
From: Julien Olivain via buildroot @ 2026-07-25 9:46 UTC (permalink / raw)
To: Bernd Kuhls; +Cc: buildroot
On 24/07/2026 19:21, Bernd Kuhls wrote:
> https://github.com/strukturag/libheif/releases/tag/v1.23.1
>
> Fixes the following CVEs:
>
> CVE-2026-62289 (GHSA-jc8f-p23p-5hjg)
> Integer underflow in Fraction constructor via double clap transform
> application
>
> CVE-2026-62291 (GHSA-xpw3-9rhw-482x)
> Heap out of bounds write in libheif uncompressed encoder when writing
> images with mismatched auxiliary alpha dimensions
>
> CVE-2026-62292 (GHSA-73p7-m7gg-w2jv)
> Out-of-bounds read in uncompressed unci tile range slicing
>
> CVE-2026-62377 (GHSA-9ww4-9v47-m7pj)
> Reachable assertion in HeifContext::get_track() aborts on a valid-but-
> empty HEIF sequence file
>
> (GHSA-46rp-pcq2-rpmr)
> Heap out-of-bounds write in the uncompressed encoder for RRGGBB images
> with interleaved bit-depth ≤ 8
>
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [Buildroot] [PATCH 1/1] package/libheif: security bump version to 1.23.1
2026-07-24 17:21 [Buildroot] [PATCH 1/1] package/libheif: security bump version to 1.23.1 Bernd Kuhls
2026-07-25 9:46 ` Julien Olivain via buildroot
@ 2026-07-31 12:22 ` Thomas Perale via buildroot
1 sibling, 0 replies; 3+ messages in thread
From: Thomas Perale via buildroot @ 2026-07-31 12:22 UTC (permalink / raw)
To: Bernd Kuhls; +Cc: Thomas Perale, buildroot
In reply of:
> https://github.com/strukturag/libheif/releases/tag/v1.23.1
>
> Fixes the following CVEs:
>
> CVE-2026-62289 (GHSA-jc8f-p23p-5hjg)
> Integer underflow in Fraction constructor via double clap transform
> application
>
> CVE-2026-62291 (GHSA-xpw3-9rhw-482x)
> Heap out of bounds write in libheif uncompressed encoder when writing
> images with mismatched auxiliary alpha dimensions
>
> CVE-2026-62292 (GHSA-73p7-m7gg-w2jv)
> Out-of-bounds read in uncompressed unci tile range slicing
>
> CVE-2026-62377 (GHSA-9ww4-9v47-m7pj)
> Reachable assertion in HeifContext::get_track() aborts on a valid-but-
> empty HEIF sequence file
>
> (GHSA-46rp-pcq2-rpmr)
> Heap out-of-bounds write in the uncompressed encoder for RRGGBB images
> with interleaved bit-depth ≤ 8
>
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Applied to 2025.02.x & 2026.05.x. Thanks
> ---
> Gitlab pipelines passed:
> https://gitlab.com/bkuhls/buildroot/-/commits/a3d9028ad1a824e62d3a0a573ceca7c79addeebd
>
> package/libheif/libheif.hash | 4 ++--
> package/libheif/libheif.mk | 2 +-
> 2 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/package/libheif/libheif.hash b/package/libheif/libheif.hash
> index 780059facf..ff8c05c7e4 100644
> --- a/package/libheif/libheif.hash
> +++ b/package/libheif/libheif.hash
> @@ -1,4 +1,4 @@
> -# From https://github.com/strukturag/libheif/releases/tag/v1.23.0
> -sha256 4c9182b18897617182eed12ab5eb9f9d855b3aa3a736d6bdb31abc034ec7d393 libheif-1.23.0.tar.gz
> +# From https://github.com/strukturag/libheif/releases/tag/v1.23.1
> +sha256 0de0327f60fcd47de90d5654c6fe152232738d60d84fe084ec3e0f35e03b166a libheif-1.23.1.tar.gz
> # Locally computed:
> sha256 fa81ce652315b013359d6e8e4744335f31a50c7c192907176d3632f78a3b4596 COPYING
> diff --git a/package/libheif/libheif.mk b/package/libheif/libheif.mk
> index be97b18bd0..124dba7c24 100644
> --- a/package/libheif/libheif.mk
> +++ b/package/libheif/libheif.mk
> @@ -4,7 +4,7 @@
> #
> ################################################################################
>
> -LIBHEIF_VERSION = 1.23.0
> +LIBHEIF_VERSION = 1.23.1
> LIBHEIF_SITE = https://github.com/strukturag/libheif/releases/download/v$(LIBHEIF_VERSION)
> LIBHEIF_LICENSE = LGPL-3.0+
> LIBHEIF_LICENSE_FILES = COPYING
> --
> 2.47.3
>
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-31 12:22 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-24 17:21 [Buildroot] [PATCH 1/1] package/libheif: security bump version to 1.23.1 Bernd Kuhls
2026-07-25 9:46 ` Julien Olivain via buildroot
2026-07-31 12:22 ` Thomas Perale via buildroot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox