GITHUB.COM/STRUKTURAG/LIBHEIF · CVE-2023-29659 · Package
FIX → 1.15.2
libheif, a library for reading HEIF and HEIC images, has a segmentation fault caused by a floating point exception in its Fraction::round() function in box.cc. A crafted image file makes any program that decodes it crash, which is a denial of service.
first public May 5, 2023 · 1 public exploit · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that decode untrusted HEIF or HEIC images with libheif before 1.15.2 can be crashed by a crafted file. Services that only process images they create themselves, or that do not use libheif, are not exposed.
Not affected if libheif-1.15.2-or-later, no-untrusted-heif-input
Who cares go, image-processing, libheif
go.mod for github.com/strukturag/libheif; affected versions are below 1.15.2.go list -m github.com/strukturag/libheif to see the resolved version.A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 1.15.2
github.com/strukturag/libheif 1.15.2