The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3675 advisory.

  - A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially     crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this     vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically     scanned by the vulnerable scanner. (CVE-2023-40889)

  - A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90.
    Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger     this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically     scanned by the vulnerable scanner. (CVE-2023-40890)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DLA-3675-1 : zbar - LTS security update

critical Nessus Plugin ID 186540

Version 1.0