Описание
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unit_offset + unit_size. Because the addition can wrap, a crafted HEIF file can pass the range check and then construct a vector from iterators outside the compressed item buffer, producing an out-of-bounds heap read and crash. Version 1.22.1 patches the issue.
A flaw was found in libheif, a decoder and encoder for HEIF and AVIF file formats. A remote attacker could exploit this vulnerability by providing a specially crafted HEIF file. The uncompressed HEIF decoder's validation of icef compressed-unit offsets can experience an integer wrap-around. This allows the attacker to cause an out-of-bounds heap read, leading to a crash and resulting in a Denial of Service (DoS) for the application using libheif.
Отчет
Moderate: This flaw in libheif, which could lead to a denial of service through a crafted HEIF file, does not affect Red Hat products. The vulnerable code responsible for the integer wrap-around in the uncompressed HEIF decoder is not present in Red Hat's supported versions of libheif.
Меры по смягчению последствий
Configure the service to automatically restart on failure to maintain uptime if an exploit triggers a crash.
Дополнительная информация
Статус:
6.5 Medium
CVSS3
Связанные уязвимости
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unit_offset + unit_size. Because the addition can wrap, a crafted HEIF file can pass the range check and then construct a vector from iterators outside the compressed item buffer, producing an out-of-bounds heap read and crash. Version 1.22.1 patches the issue.
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unit_offset + unit_size. Because the addition can wrap, a crafted HEIF file can pass the range check and then construct a vector from iterators outside the compressed item buffer, producing an out-of-bounds heap read and crash. Version 1.22.1 patches the issue.
libheif is a HEIF and AVIF file format decoder and encoder. Prior to v ...
6.5 Medium
CVSS3