CVE-2023-40889
A heap-based buffer overflow exists in the qr_reader_match_centers fun ...
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Amazon (media), Ubuntu (media).
Descripción
A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| pip::GitHub Security Advisory pip | zbar | sin corrección indicada |
| alpine 3.19 | zbar | 0.23.93-r0 |
| alpine 3.20 | zbar | 0.23.93-r0 |
| alpine 3.21 | zbar | 0.23.93-r0 |
| alpine 3.22 | zbar | 0.23.93-r0 |
| alpine 3.23 | zbar | 0.23.93-r0 |
| alpine 3.24 | zbar | 0.23.93-r0 |
| alpine edge | zbar | 0.23.93-r0 |
| amazon linux 1 | zbar, zbar-debuginfo, zbar-devel | 0.10-19.3.amzn1 |
| debian 10 | zbar | 0.22-1+deb10u1 |
| debian 11 | zbar | 0.23.90-1+deb11u1 |
| debian 12 | zbar | 0.23.92-7+deb12u1 |
Mostrar las 21 entradas de 19 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| pip::GitHub Security Advisory pip | zbar | sin corrección indicada |
| alpine 3.19 | zbar | 0.23.93-r0 |
| alpine 3.20 | zbar | 0.23.93-r0 |
| alpine 3.21 | zbar | 0.23.93-r0 |
| alpine 3.22 | zbar | 0.23.93-r0 |
| alpine 3.23 | zbar | 0.23.93-r0 |
| alpine 3.24 | zbar | 0.23.93-r0 |
| alpine edge | zbar | 0.23.93-r0 |
| amazon linux 1 | zbar | 0.10-19.3.amzn1 |
| amazon linux 1 | zbar-debuginfo | 0.10-19.3.amzn1 |
| amazon linux 1 | zbar-devel | 0.10-19.3.amzn1 |
| debian 10 | zbar | 0.22-1+deb10u1 |
| debian 11 | zbar | 0.23.90-1+deb11u1 |
| debian 12 | zbar | 0.23.92-7+deb12u1 |
| debian 13 | zbar | 0.23.92-9 |
| debian 14 | zbar | 0.23.92-9 |
| echo | zbar | 0.23.92-7+deb12u1 |
| ubuntu 16.04-ESM | zbar | 0.10+doc-10ubuntu1+esm1 |
| ubuntu 18.04-ESM | zbar | 0.10+doc-10.1ubuntu0.1~esm1 |
| ubuntu 20.04-ESM | zbar | 0.23-1.3ubuntu0.1~esm1 |
| ubuntu 22.04 | zbar | sin corrección indicada |
Referencias
- https://github.com/mchehab/zbar
- https://hackmd.io/@cspl/B1ZkFZv23
- https://lists.debian.org/debian-lts-announce/2023/12/msg00001.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/25LZZQJGGZRPLKTRNRNOTAFQJIPS7WRP
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/25LZZQJGGZRPLKTRNRNOTAFQJIPS7WRP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DC7V5YCLCPB36J2KY6WLZCABFLBRB665
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DC7V5YCLCPB36J2KY6WLZCABFLBRB665/
- https://nvd.nist.gov/vuln/detail/CVE-2023-40889