CVE-2019-11471: Use After Free
Published Apr 23, 2019
·Updated
libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::setalphachannel in heifcontext.h because heifcontext.cc mishandles references to non-existing alpha images.
Affected Software
13 affected componentsFixes available
ubuntu/libheif<1.1.0-2ubuntu0.1~
1.1.0-2ubuntu0.1~
ubuntu/libheif<1.4.0-2
1.4.0-2
ubuntu/libheif<1.4.0-2
1.4.0-2
ubuntu/libheif<1.4.0-2
1.4.0-2
ubuntu/libheif<1.4.0-2
1.4.0-2
ubuntu/libheif<1.4.0-2
1.4.0-2
ubuntu/libheif<1.4.0-2
1.4.0-2
ubuntu/libheif<1.4.0-2
1.4.0-2
ubuntu/libheif<1.4.0-2
1.4.0-2
ubuntu/libheif<1.4.0-2
1.4.0-2
ubuntu/libheif<1.4.0-2
1.4.0-2
debian/libheif
1.11.0-11.15.1-11.18.1-2
struktur Libheif=1.4.0
Remediation
Patch Available
Event History
Apr 23, 2019
CVE Published
via Ubuntu·12:00 AM
CVE Published
via MITRE·01:55 PM
Data Sourced
via MITRE·01:55 PM
Description
Jun 26, 2024
Data Sourced
via Launchpad·09:46 AM
Description
Frequently Asked Questions
1
What is CVE-2019-11471?
CVE-2019-11471 is a vulnerability in libheif 1.4.0, where a use-after-free occurs in heif::HeifContext::Image::set_alpha_channel in heif_context.h due to mishandling of references to non-existing alpha images.
2
What is the severity of CVE-2019-11471?
The severity of CVE-2019-11471 is high, with a severity value of 8.8.
3
How does CVE-2019-11471 affect the software?
CVE-2019-11471 affects the software libheif 1.4.0.
4
How can CVE-2019-11471 be fixed?
To fix CVE-2019-11471, it is recommended to update to a version of libheif that is not affected by the vulnerability.
5
What is CWE-416?
CWE-416 is a code quality vulnerability that refers to the use of uninitialized variables.