CVE-2023-29659: Divide by Zero

Q: What is CVE-2023-29659 vulnerability?

CVE-2023-29659 is a vulnerability in libheif 1.15.1 that causes a segmentation fault and denial of service when processing crafted heif images.

Q: What is the severity of CVE-2023-29659?

The severity of CVE-2023-29659 is medium with a CVSS score of 6.5.

Q: Which software versions are affected by CVE-2023-29659?

Versions up to, but not including, 1.15.2 of libheif are affected by CVE-2023-29659.

Q: How can I fix CVE-2023-29659 vulnerability?

To fix the CVE-2023-29659 vulnerability, you should update to version 1.15.2 or higher of libheif.

Q: What is the CWE ID for CVE-2023-29659?

The CWE ID for CVE-2023-29659 is CWE-369.

Published May 5, 2023

Updated

A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service.

Affected Software

5 affected componentsFixes available

go/github.com/strukturag/libheif<1.15.2

1.15.2

struktur Libheif=1.15.1

Fedoraproject Fedora=36

Fedoraproject Fedora=37

debian/libheif

1.15.1-1+deb12u11.19.8-1+deb13u11.23.6-2~deb13u11.23.6-2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade go/github.com/strukturag/libheif to a version that resolves this vulnerability.
Fixed in 1.15.2
Upgrade
Upgrade debian/libheif to a version that resolves this vulnerability.
Fixed in 1.15.1-1+deb12u1Fixed in 1.19.8-1+deb13u1Fixed in 1.23.6-2~deb13u1Fixed in 1.23.6-2

Event History

May 5, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

04:15 PM

Description

Advisory Published

via GitHub·06:30 PM

Parent advisories

This vulnerability appears in the following advisories.

DSA-5796

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-3945-1

Frequently Asked Questions

What is CVE-2023-29659 vulnerability?