Request 6539 (accepted)

We truncated the diff of some files because they were too big. If you want to see the full diff for every file, click here.

Overview

Request 6539 (accepted)

New upstream release

Created by zaitor about 9 hours ago
In state accepted

Submit libde265

Submit package home:zaitor:branches:Staging / libde265 to package Staging / libde265

libde265.changes Changed

@@ -1,4 +1,48 @@
 -------------------------------------------------------------------
+Tue Jun 16 07:40:59 UTC 2026 - Bjørn Lie <zaitor@opensuse.org>
+
+- Update to version 1.1.1:
+  + The decoding speed has been improved by about 8% on x86 CPUs
+    thanks to more SIMD acceleration and optimized CABAC code. Also
+    the startup time has been improved, which gives a 3% speed
+    improvement when decoding HEIC files with similar-sized tiles.
+  + Security:
+    - CVE-2026-54240 (GHSA-ccfw-29x7-rrx3) - Pixel accessor signed
+      integer overflow causes heap OOB read/write
+    - CVE-2026-54241 (GHSA-j2qq-x2xq-g9wr) - SAO sequential filter
+      heap buffer overflow via signed integer overflow
+- Changes from version 1.1.0:
+  + Added de265_security_limits parameters to limit the maximum
+    image size and memory that libde265 will use during decoding.
+  + Security fixes:
+    - CVE-2026-49295 (GHSA-g2rg-wj66-w594) - Out-of-bounds write in
+      process_reference_picture_set via predicted short-term RPS
+    - CVE-2026-49337 (GHSA-g5hj-rf9f-7vxm) - Unbounded memory
+      accumulation via orphaned slice headers in read_slice_NAL
+    - CVE-2026-49346 (GHSA-vv8h-932h-7r86) - Heap buffer overflow
+      in de265_image_get_buffer via SPS dimension integer overflow
+    - (GHSA-x27c-jp65-g395) - Quadratic CPU consumption in NAL
+      parser (remove_stuffing_bytes, resize)
+- Changes from version 1.0.19:
+  + This release contains a number of security fixes, correctness
+    fixes for edge cases, and build/packaging improvements.
+    The public API is binary-compatible with v1.0.18.
+  + Security fixes:
+    - CVE-2026-45382 (GHSA-hwhx-x2mq-ccr9) : Heap-buffer-overflow
+      READ in decode_slice_unit_tiles via unvalidated PPS tile
+      geometry.
+    - CVE-2026-45383 (GHSA-wg9q-ppqw-6q38) : Heap buffer overflow
+      (OOB read) in decode_slice_unit_WPP() via out-of-bounds
+      CtbAddrRStoTS access
+- Changes from version 1.0.18:
+  + libde265ConfigVersion.cmake renamed to
+    libde265-config-version.cmake
+  + fix pkg-config when installing to absolute paths
+  + fix compilation with MSVC in Debug mode
+  + removed the (defunct) encoder code and the internal development
+    tools from the tarball.
+
+-------------------------------------------------------------------
 Wed Mar 18 13:35:29 UTC 2026 - Bjørn Lie <zaitor@opensuse.org>
 
 - Update to version 1.0.17:

libde265.spec Changed

libde265-1.0.17.tar.gz -> libde265-1.1.1.tar.gz Changed

Build Results
RPM Lint

Refresh

Mentioned Issues (7)

CVE-2026-45382
CVE-2026-45383
CVE-2026-49295
CVE-2026-49337
CVE-2026-49346
CVE-2026-54240
CVE-2026-54241

Comments for request 6539 0

Request History

zaitor created request about 9 hours ago

New upstream release

olh accepted request about 7 hours ago