Ubuntu alert USN-8683-1 (libheif)
| From: | noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-8683-1] libheif vulnerabilities | |
| Date: | Wed, 26 Aug 2026 23:04:42 +0000 | |
| Message-ID: | <E1wzMfi-00046m-Ao@lists.ubuntu.com> | |
| Cc: | noreply+usn-bot@canonical.com |
========================================================================== Ubuntu Security Notice USN-8683-1 August 26, 2026 libheif vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in libheif. Software Description: - libheif: An ISO/IEC 23008-12:2017 HEIF and AVIF file format decoder and encoder Details: Feng Ning discovered that libheif incorrectly handled certain image transforms. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-62289) Ali Firas discovered that libheif incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 24.04 LTS. (CVE-2026-62291) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS heif-gdk-pixbuf 1.17.6-1ubuntu4.8 heif-thumbnailer 1.17.6-1ubuntu4.8 libheif-dev 1.17.6-1ubuntu4.8 libheif-plugin-aomdec 1.17.6-1ubuntu4.8 libheif-plugin-aomenc 1.17.6-1ubuntu4.8 libheif-plugin-dav1d 1.17.6-1ubuntu4.8 libheif-plugin-ffmpegdec 1.17.6-1ubuntu4.8 libheif-plugin-j2kdec 1.17.6-1ubuntu4.8 libheif-plugin-j2kenc 1.17.6-1ubuntu4.8 libheif-plugin-jpegdec 1.17.6-1ubuntu4.8 libheif-plugin-jpegenc 1.17.6-1ubuntu4.8 libheif-plugin-libde265 1.17.6-1ubuntu4.8 libheif-plugin-rav1e 1.17.6-1ubuntu4.8 libheif-plugin-svtenc 1.17.6-1ubuntu4.8 libheif-plugin-x265 1.17.6-1ubuntu4.8 libheif1 1.17.6-1ubuntu4.8 Ubuntu 22.04 LTS heif-gdk-pixbuf 1.12.0-2ubuntu0.1~esm4 Available with Ubuntu Pro heif-thumbnailer 1.12.0-2ubuntu0.1~esm4 Available with Ubuntu Pro libheif-dev 1.12.0-2ubuntu0.1~esm4 Available with Ubuntu Pro libheif1 1.12.0-2ubuntu0.1~esm4 Available with Ubuntu Pro Ubuntu 20.04 LTS heif-gdk-pixbuf 1.6.1-1ubuntu0.1~esm4 Available with Ubuntu Pro heif-thumbnailer 1.6.1-1ubuntu0.1~esm4 Available with Ubuntu Pro libheif-dev 1.6.1-1ubuntu0.1~esm4 Available with Ubuntu Pro libheif1 1.6.1-1ubuntu0.1~esm4 Available with Ubuntu Pro Ubuntu 18.04 LTS libheif-dev 1.1.0-2ubuntu0.1~esm4 Available with Ubuntu Pro libheif1 1.1.0-2ubuntu0.1~esm4 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8683-1 CVE-2026-62289, CVE-2026-62291 Package Information: https://launchpad.net/ubuntu/+source/libheif/1.17.6-1ubun...
Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmqPaZgACgkQcpJm3tlz hgFfJxAAhaQDeM9Ja3Hq6mcuSCI0aSEJeNHCoptOB5S4kHKAZCz7NVkI3N1rz/Ka xqmMy/zgdSULzCLPkgiFm1yfYuv4TPSB62o0tunUzENTM1iApGTozqaHJFusnAEQ NGZlpgV6oLo363xyG1re2dNrzi9H3IE7cPj5TGOoUz8D4Ra6NWUirhk37Byx/CG2 qBAHWjZXNffI9pHNwnSvvNGOP9Cb2y3sTJohn//yaxtNfbJffq99K9YB/FsEDPOv 00Dn2qoluuXm1HmVJegGu55fCtKiyhbCkzSQM/PDufJK4UR1oaKCmwiTqjZk7ots xeT+QdM0eXrSNzZhIFJHrfFPhNvv1pYTeClvbvXT1DR9dShubwqAOq5lK0RUC3JF 0IgD9HrN79DwTBrt0sjz00G9J0xOKUjYTQdvuuLwZ+WJ3Eg2need07A3C4eMgf5Q kuFlWCkbLCPKOmzlBiu1N+kTs9qJYxwb0qnVMXBpELxQNL/VVuJkUxJtLC1ZU53i 9a6Tz+SUG9mrOyGZ70StlbOgOMtK3RtGpI7jOHY1lKSWwpH5v7mp04yHxWgSZgBC dXM4gsAKzo1jFF4OYi6uzDNODbewPRV1BU/bZMp5y0fZlwNoD/+Hxh8AIzb2/BM2 jCe0Eeajeg3QstlZXp/uLa40461urYPHCyeOD0aB3uSwmaJwjk4= =hDGT -----END PGP SIGNATURE-----