CVE-2023-29659: Divide by Zero
Published May 5, 2023
·Updated
A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service.
Affected Software
5 affected componentsFixes available
debian/libheif<=1.11.0-1, <=1.15.1-1
1.18.1-2
go/github.com/strukturag/libheif<1.15.2
1.15.2
struktur Libheif=1.15.1
Fedoraproject Fedora=36
Fedoraproject Fedora=37
Remediation
Event History
May 5, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
04:15 PM
Description
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Advisory Published
06:30 PM
Data Sourced
via GitHub·06:30 PM
DescriptionSeverityWeaknessAffected Software
Jun 26, 2024
Data Sourced
via Launchpad·09:46 AM
Description
Sep 14, 2024
Data Sourced
via Ubuntu·10:00 AM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is CVE-2023-29659 vulnerability?
CVE-2023-29659 is a vulnerability in libheif 1.15.1 that causes a segmentation fault and denial of service when processing crafted heif images.
2
What is the severity of CVE-2023-29659?
The severity of CVE-2023-29659 is medium with a CVSS score of 6.5.
3
Which software versions are affected by CVE-2023-29659?
Versions up to, but not including, 1.15.2 of libheif are affected by CVE-2023-29659.
4
How can I fix CVE-2023-29659 vulnerability?
To fix the CVE-2023-29659 vulnerability, you should update to version 1.15.2 or higher of libheif.
5
What is the CWE ID for CVE-2023-29659?
The CWE ID for CVE-2023-29659 is CWE-369.