In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with forged offsets can lead to an out-of-bounds read and write.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-8fdb7be3cb advisory.

    Latest upstream release. It adds support for tiles and fixes reading images generated by iOS 18+. See     https://github.com/strukturag/libheif/releases for more details about the changes since 1.17.6.

    **NOTE:** `heif-convert` tool was renamed to `heif-dec`.

    How to test:
    ==========

    Download and unzip sample images from [mastodon issue #31570](https://github.com/user-     attachments/files/16734152/HEIF-images.zip). Try opening them with e.g. `loupe` or `gimp`. They fail to     open with `libheif-1.17.6`, but should open successfully with `libheif-1.19.5`.

    Fixes [CVE-2024-41311](https://github.com/advisories/GHSA-mwf7-wfvq-vc32) .

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-666aaa6a0d advisory.

    Latest upstream release. It adds support for tiles and fixes reading images generated by iOS 18+. See     https://github.com/strukturag/libheif/releases for more details about the changes since 1.17.6.

    **NOTE:** `heif-convert` tool was renamed to `heif-dec`.

    How to test:
    ==========

    Download and unzip sample images from [mastodon issue #31570](https://github.com/user-     attachments/files/16734152/HEIF-images.zip). Try opening them with e.g. `loupe` or `gimp`. They fail to     open with `libheif-1.17.6`, but should open successfully with `libheif-1.19.5`.

    Fixes [CVE-2024-41311](https://github.com/advisories/GHSA-mwf7-wfvq-vc32) .

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3960-1 advisory.

    - CVE-2024-41311: Fixed out-of-bounds read and write in ImageOverlay:parse() due to decoding a heif file     containing an overlay image with forged offsets (bsc#1231714).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5796 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5796-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     October 25, 2024                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : libheif     CVE ID         : CVE-2023-29659 CVE-2023-49462 CVE-2024-41311

    Multiple security issues were found in libheif, a library to parse HEIF     and AVIF files, which could result in denial of service or potentially     the execution of arbitrary code.

    For the stable distribution (bookworm), these problems have been fixed in     version 1.15.1-1+deb12u1.

    We recommend that you upgrade your libheif packages.

    For the detailed security status of libheif please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libheif

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7082-1 advisory.

    Gerrard Tai discovered that libheif did not properly validate certain images, leading to out-of-bounds     read and write vulnerability. If a user or automated system were tricked into opening a specially crafted     file, an attacker could possibly use this issue to cause a denial of service or to obtain sensitive     information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3934 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3934-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     October 22, 2024                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libheif     Version        : 1.11.0-1+deb11u1     CVE ID         : CVE-2024-41311

    It was discovered that there was a potential out-of-bounds read     vulnerability in libheif, a decoder and encoder for the HEIF and AVIF     image formats.

    Insufficient checks in ImageOverlay::parse() could have been     exploited by an overlay image with forged offsets which could, in     turn, have led to undefined behaviour.

    For Debian 11 bullseye, this problem has been fixed in version     1.11.0-1+deb11u1.

    We recommend that you upgrade your libheif packages.

    For the detailed security status of libheif please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libheif

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
216347	Fedora 41 : libheif (2025-8fdb7be3cb)	Nessus	Fedora Local Security Checks	high
216346	Fedora 40 : libheif (2025-666aaa6a0d)	Nessus	Fedora Local Security Checks	high
210707	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libheif (SUSE-SU-2024:3960-1)	Nessus	SuSE Local Security Checks	high
209674	Debian dsa-5796 : heif-gdk-pixbuf - security update	Nessus	Debian Local Security Checks	high
209555	Ubuntu 24.04 LTS : libheif vulnerability (USN-7082-1)	Nessus	Ubuntu Local Security Checks	high
209531	Debian dla-3934 : heif-gdk-pixbuf - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2024-41311

high

Tenable Plugins

high

high

high

high

high

high