A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.

ubuntu_linux USN-7118-1: Ubuntu 16.04 LTS / Ubuntu 18.04 LTS / Ubuntu 20.04 LTS / Ubuntu 22.04 LTS : ZBar vulnerabilities (USN-7118-1)

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5614 advisory.

  - A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially     crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this     vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically     scanned by the vulnerable scanner. (CVE-2023-40889)

  - A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90.
    Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger     this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically     scanned by the vulnerable scanner. (CVE-2023-40890)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-583e4098b9 advisory.

    0.23.93, fixes for two CVEs

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-73d5220ed3 advisory.

    0.23.93, fixes for two CVEs

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4948-1 advisory.

  - A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially     crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this     vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically     scanned by the vulnerable scanner. (CVE-2023-40889)

  - A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90.
    Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger     this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically     scanned by the vulnerable scanner. (CVE-2023-40890)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3675 advisory.

  - A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially     crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this     vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically     scanned by the vulnerable scanner. (CVE-2023-40889)

  - A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90.
    Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger     this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically     scanned by the vulnerable scanner. (CVE-2023-40890)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
189975	Debian dsa-5614 : gir1.2-zbar-1.0 - security update	Nessus	Debian Local Security Checks	critical
189160	Fedora 38 : zbar (2024-583e4098b9)	Nessus	Fedora Local Security Checks	critical
189159	Fedora 39 : zbar (2024-73d5220ed3)	Nessus	Fedora Local Security Checks	critical
187275	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : zbar (SUSE-SU-2023:4948-1)	Nessus	SuSE Local Security Checks	critical
186540	Debian DLA-3675-1 : zbar - LTS security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2023-40889

critical

Tenable Plugins

Coming Soon

critical

critical

critical

critical

critical