Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-62292: libheif: Out-of-bounds read in uncompressed unci tile range slicing CVE-2026-62289: libheif: Integer underflow in Fraction constructor via double clap transform application
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | heif-pixbuf-loader | 0:1.19.8-1.amzn2023.0.8 |
| Amazon Linux · 2023 | heif-pixbuf-loader-debuginfo | 0:1.19.8-1.amzn2023.0.8 |
| Amazon Linux · 2023 | libheif | 0:1.19.8-1.amzn2023.0.8 |
| Amazon Linux · 2023 | libheif-debuginfo | 0:1.19.8-1.amzn2023.0.8 |
| Amazon Linux · 2023 | libheif-debugsource | 0:1.19.8-1.amzn2023.0.8 |
| Amazon Linux · 2023 | libheif-devel | 0:1.19.8-1.amzn2023.0.8 |
| Amazon Linux · 2023 | libheif-tools | 0:1.19.8-1.amzn2023.0.8 |
| Amazon Linux · 2023 | libheif-tools-debuginfo | 0:1.19.8-1.amzn2023.0.8 |
Vulnerabilities 2
-
High 8.7
libheif: Out-of-bounds read in uncompressed unci tile range slicing
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_…
-
Medium 4.3
libheif: Integer underflow in Fraction constructor via double clap transform application
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(ha…