CVE-2023-40889
A heap-based buffer overflow exists in the qr_reader_match_centers fun ...
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA. Niedriger laut Amazon (mittel), Ubuntu (mittel).
Beschreibung
A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| pip::GitHub Security Advisory pip | zbar | kein Fix angegeben |
| alpine 3.19 | zbar | 0.23.93-r0 |
| alpine 3.20 | zbar | 0.23.93-r0 |
| alpine 3.21 | zbar | 0.23.93-r0 |
| alpine 3.22 | zbar | 0.23.93-r0 |
| alpine 3.23 | zbar | 0.23.93-r0 |
| alpine 3.24 | zbar | 0.23.93-r0 |
| alpine edge | zbar | 0.23.93-r0 |
| amazon linux 1 | zbar, zbar-debuginfo, zbar-devel | 0.10-19.3.amzn1 |
| debian 10 | zbar | 0.22-1+deb10u1 |
| debian 11 | zbar | 0.23.90-1+deb11u1 |
| debian 12 | zbar | 0.23.92-7+deb12u1 |
Alle 21 Einträge aus 19 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| pip::GitHub Security Advisory pip | zbar | kein Fix angegeben |
| alpine 3.19 | zbar | 0.23.93-r0 |
| alpine 3.20 | zbar | 0.23.93-r0 |
| alpine 3.21 | zbar | 0.23.93-r0 |
| alpine 3.22 | zbar | 0.23.93-r0 |
| alpine 3.23 | zbar | 0.23.93-r0 |
| alpine 3.24 | zbar | 0.23.93-r0 |
| alpine edge | zbar | 0.23.93-r0 |
| amazon linux 1 | zbar | 0.10-19.3.amzn1 |
| amazon linux 1 | zbar-debuginfo | 0.10-19.3.amzn1 |
| amazon linux 1 | zbar-devel | 0.10-19.3.amzn1 |
| debian 10 | zbar | 0.22-1+deb10u1 |
| debian 11 | zbar | 0.23.90-1+deb11u1 |
| debian 12 | zbar | 0.23.92-7+deb12u1 |
| debian 13 | zbar | 0.23.92-9 |
| debian 14 | zbar | 0.23.92-9 |
| echo | zbar | 0.23.92-7+deb12u1 |
| ubuntu 16.04-ESM | zbar | 0.10+doc-10ubuntu1+esm1 |
| ubuntu 18.04-ESM | zbar | 0.10+doc-10.1ubuntu0.1~esm1 |
| ubuntu 20.04-ESM | zbar | 0.23-1.3ubuntu0.1~esm1 |
| ubuntu 22.04 | zbar | kein Fix angegeben |
Referenzen
- https://github.com/mchehab/zbar
- https://hackmd.io/@cspl/B1ZkFZv23
- https://lists.debian.org/debian-lts-announce/2023/12/msg00001.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/25LZZQJGGZRPLKTRNRNOTAFQJIPS7WRP
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/25LZZQJGGZRPLKTRNRNOTAFQJIPS7WRP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DC7V5YCLCPB36J2KY6WLZCABFLBRB665
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DC7V5YCLCPB36J2KY6WLZCABFLBRB665/
- https://nvd.nist.gov/vuln/detail/CVE-2023-40889