CVE-2019-11471: Use After Free
libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::setalphachannel in heifcontext.h because heifcontext.cc mishandles references to non-existing alpha images.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libheifto a version that resolves this vulnerability.Fixed in 1.1.0-2ubuntu0.1~ - Upgrade
Upgrade
ubuntu/libheifto a version that resolves this vulnerability.Fixed in 1.4.0-2 - Upgrade
Upgrade
debian/libheifto a version that resolves this vulnerability.Fixed in 1.11.0-1Fixed in 1.15.1-1Fixed in 1.18.1-2 - Upgrade
Upgrade
alpine/libheifto a version that resolves this vulnerability.Fixed in 1.5.0-r0
Event History
Frequently Asked Questions
What is CVE-2019-11471?
CVE-2019-11471 is a vulnerability in libheif 1.4.0, where a use-after-free occurs in heif::HeifContext::Image::set_alpha_channel in heif_context.h due to mishandling of references to non-existing alpha images.
What is the severity of CVE-2019-11471?
The severity of CVE-2019-11471 is high, with a severity value of 8.8.
How does CVE-2019-11471 affect the software?
CVE-2019-11471 affects the software libheif 1.4.0.
How can CVE-2019-11471 be fixed?
To fix CVE-2019-11471, it is recommended to update to a version of libheif that is not affected by the vulnerability.
What is CWE-416?
CWE-416 is a code quality vulnerability that refers to the use of uninitialized variables.