A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7118-1 advisory.

    It was discovered that ZBar did not properly handle certain QR codes. If a user or automated system using     ZBar were tricked into opening a specially crafted file, an attacker could possibly use this to obtain     sensitive information.

    (CVE-2023-40889)

    It was discovered that ZBar did not properly handle certain QR codes. If a user or automated system using     ZBar were tricked into opening a specially crafted file, an attacker could possibly use this to obtain     sensitive information. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-40890)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5614 advisory.

  - A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially     crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this     vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically     scanned by the vulnerable scanner. (CVE-2023-40889)

  - A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90.
    Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger     this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically     scanned by the vulnerable scanner. (CVE-2023-40890)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-583e4098b9 advisory.

    0.23.93, fixes for two CVEs

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-73d5220ed3 advisory.

    0.23.93, fixes for two CVEs

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4948-1 advisory.

  - A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially     crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this     vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically     scanned by the vulnerable scanner. (CVE-2023-40889)

  - A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90.
    Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger     this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically     scanned by the vulnerable scanner. (CVE-2023-40890)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3675 advisory.

  - A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially     crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this     vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically     scanned by the vulnerable scanner. (CVE-2023-40889)

  - A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90.
    Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger     this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically     scanned by the vulnerable scanner. (CVE-2023-40890)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211736	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : ZBar vulnerabilities (USN-7118-1)	Nessus	Ubuntu Local Security Checks	critical
189975	Debian dsa-5614 : gir1.2-zbar-1.0 - security update	Nessus	Debian Local Security Checks	critical
189160	Fedora 38 : zbar (2024-583e4098b9)	Nessus	Fedora Local Security Checks	critical
189159	Fedora 39 : zbar (2024-73d5220ed3)	Nessus	Fedora Local Security Checks	critical
187275	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : zbar (SUSE-SU-2023:4948-1)	Nessus	SuSE Local Security Checks	critical
186540	Debian DLA-3675-1 : zbar - LTS security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2023-40890

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical