CVE-2023-40890
A stack-based buffer overflow vulnerability exists in the lookup_seque ...
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Amazon (media), Ubuntu (media).
Descripción
A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.19 | zbar | 0.23.93-r0 |
| alpine 3.20 | zbar | 0.23.93-r0 |
| alpine 3.21 | zbar | 0.23.93-r0 |
| alpine 3.22 | zbar | 0.23.93-r0 |
| alpine 3.23 | zbar | 0.23.93-r0 |
| alpine 3.24 | zbar | 0.23.93-r0 |
| alpine edge | zbar | 0.23.93-r0 |
| amazon linux 1 | zbar, zbar-debuginfo, zbar-devel | 0.10-19.3.amzn1 |
| debian 10 | zbar | 0.22-1+deb10u1 |
| debian 11 | zbar | 0.23.90-1+deb11u1 |
| debian 12 | zbar | 0.23.92-7+deb12u1 |
| debian 13 | zbar | 0.23.92-9 |
Mostrar las 18 entradas de 16 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.19 | zbar | 0.23.93-r0 |
| alpine 3.20 | zbar | 0.23.93-r0 |
| alpine 3.21 | zbar | 0.23.93-r0 |
| alpine 3.22 | zbar | 0.23.93-r0 |
| alpine 3.23 | zbar | 0.23.93-r0 |
| alpine 3.24 | zbar | 0.23.93-r0 |
| alpine edge | zbar | 0.23.93-r0 |
| amazon linux 1 | zbar | 0.10-19.3.amzn1 |
| amazon linux 1 | zbar-debuginfo | 0.10-19.3.amzn1 |
| amazon linux 1 | zbar-devel | 0.10-19.3.amzn1 |
| debian 10 | zbar | 0.22-1+deb10u1 |
| debian 11 | zbar | 0.23.90-1+deb11u1 |
| debian 12 | zbar | 0.23.92-7+deb12u1 |
| debian 13 | zbar | 0.23.92-9 |
| debian 14 | zbar | 0.23.92-9 |
| echo | zbar | 0.23.92-7+deb12u1 |
| ubuntu 20.04-ESM | zbar | 0.23-1.3ubuntu0.1~esm1 |
| ubuntu 22.04 | zbar | sin corrección indicada |
Referencias
- https://hackmd.io/@cspl/H1PxPAUnn
- https://lists.debian.org/debian-lts-announce/2023/12/msg00001.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/25LZZQJGGZRPLKTRNRNOTAFQJIPS7WRP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DC7V5YCLCPB36J2KY6WLZCABFLBRB665/
- https://ubuntu.com/security/notices/USN-7118-1
- https://www.cve.org/CVERecord?id=CVE-2023-40890