Re: Vulnerabilities in libheif and libde265
Hanno Böck flags a security-relevant libheif fix (GHSA-v8qw-hwjv-44hw) rejecting oversized in-band coded image sizes, absent from release 1.23.4.
A follow-up to the libheif/libde265 vulnerability discussion notes that commit 6ce2bba in strukturag/libheif rejects in-band coded image sizes exceeding the security limit for all codecs, tracked as GHSA-v8qw-hwjv-44hw. A crafted image can declare a small size in its container 'ispe' property while the actual coded image is larger, bypassing prior validation. The fix was not included in the libheif 1.23.4 release.
- Crafted HEIF images can understate coded size via the 'ispe' property
- Fix tracked as GHSA-v8qw-hwjv-44hw; not shipped in libheif 1.23.4
- Size validation weakness applies across codecs in libheif
- Vendors
- strukturag
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 6ce2bba558a27b63a508e81c085025f91c89899b | on Sep 19 Hi, https://github.com/strukturag/libheif/commit/6ce2bba558a27b63a508e81c085025f91c89899b sounds like it could be security-related and it is not part |
From the original article
Posted by Hanno Böck on Sep 19 Hi, https://github. com/strukturag/libheif/commit/6ce2bba558a27b63a508e81c085025f91c89899b sounds like it could be security-related and it is not part of the 1. 23.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.