ZeroHour
oss-securitypublished ()ingested
Part of a story covered by 2 sources: “Multiple security advisories for libheif and libde265; size-validation fix (GHSA-v8qw-hwjv-44hw) missing from libheif 1.23.4” — merged summary and timeline →

Re: Vulnerabilities in libheif and libde265

lowVulnerabilityimportance 22
AI summary · glm-5.3-flash

Hanno Böck flags a security-relevant libheif fix (GHSA-v8qw-hwjv-44hw) rejecting oversized in-band coded image sizes, absent from release 1.23.4.

A follow-up to the libheif/libde265 vulnerability discussion notes that commit 6ce2bba in strukturag/libheif rejects in-band coded image sizes exceeding the security limit for all codecs, tracked as GHSA-v8qw-hwjv-44hw. A crafted image can declare a small size in its container 'ispe' property while the actual coded image is larger, bypassing prior validation. The fix was not included in the libheif 1.23.4 release.

  • Crafted HEIF images can understate coded size via the 'ispe' property
  • Fix tracked as GHSA-v8qw-hwjv-44hw; not shipped in libheif 1.23.4
  • Size validation weakness applies across codecs in libheif

Indicators of compromiseAll →

TypeIndicatorContext
sha16ce2bba558a27b63a508e81c085025f91c89899bon Sep 19 Hi, https://github.com/strukturag/libheif/commit/6ce2bba558a27b63a508e81c085025f91c89899b sounds like it could be security-related and it is not part
Full article

Posted by Hanno Böck on Sep 19 Hi, https://github.com/strukturag/libheif/commit/6ce2bba558a27b63a508e81c085025f91c89899b sounds like it could be security-related and it is not part of the 1.23.4 release. Copying over commit description: --------- Reject in-band coded image sizes over the security limit for all codecs (GHSA-v8qw-hwjv-44hw) A crafted image can declare a small size in its container 'ispe' property while...

This source does not provide full text. Read it at seclists.org.