Ubuntu alert USN-8846-1 (libheif)
| From: | noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-8846-1] libheif vulnerabilities | |
| Date: | Tue, 29 Sep 2026 20:28:30 +0000 | |
| Message-ID: | <E1xBeRC-0001G8-87@lists.ubuntu.com> | |
| Cc: | noreply+usn-bot@canonical.com |
========================================================================== Ubuntu Security Notice USN-8846-1 September 29, 2026 libheif vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in libheif. Software Description: - libheif: An ISO/IEC 23008-12:2017 HEIF and AVIF file format decoder and encoder Details: Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain compressed metadata. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-84384) Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain HEIF sequence data. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-84446) Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain image references. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-84447) It was discovered that libheif incorrectly handled certain region masks. A local attacker could possibly use this issue to obtain sensitive information or cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-84448) It was discovered that libheif incorrectly handled certain images. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-84449) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS heif-gdk-pixbuf 1.21.2-3ubuntu0.6 heif-thumbnailer 1.21.2-3ubuntu0.6 heif-view 1.21.2-3ubuntu0.6 libheif-dev 1.21.2-3ubuntu0.6 libheif-plugin-aomdec 1.21.2-3ubuntu0.6 libheif-plugin-aomenc 1.21.2-3ubuntu0.6 libheif-plugin-dav1d 1.21.2-3ubuntu0.6 libheif-plugin-ffmpegdec 1.21.2-3ubuntu0.6 libheif-plugin-j2kdec 1.21.2-3ubuntu0.6 libheif-plugin-j2kenc 1.21.2-3ubuntu0.6 libheif-plugin-jpegdec 1.21.2-3ubuntu0.6 libheif-plugin-jpegenc 1.21.2-3ubuntu0.6 libheif-plugin-kvazaar 1.21.2-3ubuntu0.6 libheif-plugin-libde265 1.21.2-3ubuntu0.6 libheif-plugin-rav1e 1.21.2-3ubuntu0.6 libheif-plugin-svtenc 1.21.2-3ubuntu0.6 libheif-plugin-x265 1.21.2-3ubuntu0.6 libheif-plugins-all 1.21.2-3ubuntu0.6 libheif1 1.21.2-3ubuntu0.6 Ubuntu 24.04 LTS heif-gdk-pixbuf 1.17.6-1ubuntu4.9 heif-thumbnailer 1.17.6-1ubuntu4.9 libheif-dev 1.17.6-1ubuntu4.9 libheif-plugin-aomdec 1.17.6-1ubuntu4.9 libheif-plugin-aomenc 1.17.6-1ubuntu4.9 libheif-plugin-dav1d 1.17.6-1ubuntu4.9 libheif-plugin-ffmpegdec 1.17.6-1ubuntu4.9 libheif-plugin-j2kdec 1.17.6-1ubuntu4.9 libheif-plugin-j2kenc 1.17.6-1ubuntu4.9 libheif-plugin-jpegdec 1.17.6-1ubuntu4.9 libheif-plugin-jpegenc 1.17.6-1ubuntu4.9 libheif-plugin-libde265 1.17.6-1ubuntu4.9 libheif-plugin-rav1e 1.17.6-1ubuntu4.9 libheif-plugin-svtenc 1.17.6-1ubuntu4.9 libheif-plugin-x265 1.17.6-1ubuntu4.9 libheif1 1.17.6-1ubuntu4.9 Ubuntu 22.04 LTS heif-gdk-pixbuf 1.12.0-2ubuntu0.1~esm5 Available with Ubuntu Pro heif-thumbnailer 1.12.0-2ubuntu0.1~esm5 Available with Ubuntu Pro libheif-dev 1.12.0-2ubuntu0.1~esm5 Available with Ubuntu Pro libheif1 1.12.0-2ubuntu0.1~esm5 Available with Ubuntu Pro Ubuntu 20.04 LTS heif-gdk-pixbuf 1.6.1-1ubuntu0.1~esm5 Available with Ubuntu Pro heif-thumbnailer 1.6.1-1ubuntu0.1~esm5 Available with Ubuntu Pro libheif-dev 1.6.1-1ubuntu0.1~esm5 Available with Ubuntu Pro libheif1 1.6.1-1ubuntu0.1~esm5 Available with Ubuntu Pro Ubuntu 18.04 LTS libheif-dev 1.1.0-2ubuntu0.1~esm5 Available with Ubuntu Pro libheif1 1.1.0-2ubuntu0.1~esm5 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8846-1 CVE-2026-84384, CVE-2026-84446, CVE-2026-84447, CVE-2026-84448, CVE-2026-84449 Package Information: https://launchpad.net/ubuntu/+source/libheif/1.21.2-3ubun... https://launchpad.net/ubuntu/+source/libheif/1.17.6-1ubun...
Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmq8GbwACgkQcpJm3tlz hgFKpg//VMNA/25eAIDWjbISgVQIWumNLfrLbq1EMFqmOJUAN8o5au0qCtLteyfk DrexEMElkn24zek+E5Yy4DRvTMUb1WPrU1UgP9oEKGvAZ2IDFTZAe17INCmRggTS q0N3s0qD10OaLcXCAgy+xHokh5J8lDdWtL0+/9yW3/nGPsdmGKBGuxgFCTb/h8ba /MUh+bvjh1jB86Kn4MEnN0fA+s4Oa4/6pQc7kug8SpF8mf4lLsmmtAzupUufzZjb uU4BGiLlcNwhWMxvxUyb+yjCIBZqShZsLHZs/SPjsXtmwy9uLPcN4keK+xY2/K92 ZlOLogzMsE1EeIFs+YLbS02mKAUnojpsBq7WuasekdS0Im4jWoHde0K40NSopHfd qnwYLk8PgTfklSsqcqzDoCnkJkQ0zjFNEa3qpecwKecO9UdTCSXr54VyBkWG9Ncw EfKlxdnDZLJ1p7MUD95LYRqhUTYMuEvAlHOzi2f/nVQILg8P9zXXDSojFLKA1Ca1 mKFiJaLVGS/78ISZheduvhkzUy97SAw0PqJNw3ZOgHz46u6YAQde6800B59l/yyL Vkdw7IemyLiwQUWBQg6X85q5fsh+J+hxomxQEGfEUaJSikROnzw64aJ4s8dmWGRS kGGP3kd1OPRryiAzIt/RD3SUkub2fWSgkDrJOGl2+W8eeEONjHU= =Gu4S -----END PGP SIGNATURE-----