- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3934-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                           Chris Lamb
October 22, 2024                              https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : libheif
Version        : 1.11.0-1+deb11u1
CVE ID         : CVE-2024-41311

It was discovered that there was a potential out-of-bounds read
vulnerability in libheif, a decoder and encoder for the HEIF and AVIF
image formats.

Insufficient checks in ImageOverlay::parse() could have been
exploited by an overlay image with forged offsets which could, in
turn, have led to undefined behaviour.

For Debian 11 bullseye, this problem has been fixed in version
1.11.0-1+deb11u1.

We recommend that you upgrade your libheif packages.

For the detailed security status of libheif please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libheif

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS