Gnoppix Security released GSA-6583-1, a security update for the libheif library. The update applies to Gnoppix 24/25 (oldstable) and Gnoppix 26 (stable). Apply the fix before processing unfamiliar image files.
Affected Releases
- Gnoppix 24/25 (oldstable): fixed libheif packages are available in the Gnoppix Security repository.
- Gnoppix 26 (stable): fixed libheif packages are available in the Gnoppix Security repository.
Impact
libheif handles HEIF and AVIF image formats. Vulnerabilities in the library could let an attacker deliver a crafted image that crashes the application. In worst cases, that can lead to arbitrary code execution.
Upgrade now if your service accepts HEIF or AVIF files from external users.
Action Required
Upgrade libheif to the fixed version listed in GSA-6583-1. Restart all dependent services after the upgrade. If an immediate upgrade is impossible, avoid opening untrusted HEIF or AVIF files until the patch is applied. - Please update your systems.