CVE-2023-40889: Buffer Overflow
A heap-based buffer overflow exists in the qrreadermatchcenters function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-40889?
CVE-2023-40889 is considered high severity due to its potential for triggering a heap-based buffer overflow leading to information disclosure and arbitrary code execution.
How do I fix CVE-2023-40889?
To fix CVE-2023-40889, upgrade ZBar to versions 0.23.90-1+deb11u1, 0.23.92-7+deb12u1, 0.23.93-5, or 0.23.93-6.
What software is affected by CVE-2023-40889?
CVE-2023-40889 affects ZBar version 0.23.90, which is available through packages on pip and Debian repositories.
What types of attacks can exploit CVE-2023-40889?
CVE-2023-40889 can be exploited through specially crafted QR codes, which when scanned, may lead to an overflow and execution of arbitrary code.
Is it possible to mitigate CVE-2023-40889 without a software update?
Mitigation options without software updates are limited, but you can limit exposure by controlling the input of QR codes from untrusted sources.