libheif can run code from crafted HEIF images
Original title: USN-9012-1: libheif vulnerability
Ubuntu says opening a malicious HEIF file, by a user or automated system, could lead to arbitrary code execution.
Ubuntu security notice USN-9012-1 reports a libheif flaw found by Alex Thomas. libheif incorrectly handled certain HEIF images. An attacker could possibly execute arbitrary code if a user or automated system were tricked into opening a specially crafted file. The feed snippet does not name a CVE, affected versions, or a fixed release.
Unconfirmed: No CVE, affected range, fix version, or exploitation status appears in the snippet.
- Alex Thomas reported incorrect handling of certain HEIF images.
- Exploitation requires opening a specially crafted file.
- The notice does not state a CVE id or fixed version in the snippet.
Impact: Arbitrary code execution via a crafted HEIF file
| Product | Affected |
|---|---|
| Ubuntu libheif | — |
- 1.Apply the Ubuntu update in USN-9012-1 for libheif.
From the original article
Alex Thomas discovered that libheif incorrectly handled certain HEIF images. An attacker could possibly use this issue to execute arbitrary code if a user or automated system were tricked into opening a specially crafted file.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.