CVE-2023-40889: Buffer Overflow
A heap-based buffer overflow exists in the qrreadermatchcenters function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/zbarto a version that resolves this vulnerability.Fixed in 0.23.90-1+deb11u1Fixed in 0.23.92-7+deb12u1Fixed in 0.23.93-5Fixed in 0.23.93-6 - Upgrade
Upgrade
alpine/zbarto a version that resolves this vulnerability.Fixed in 0.23.93-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2023-40889?
CVE-2023-40889 is considered high severity due to its potential for triggering a heap-based buffer overflow leading to information disclosure and arbitrary code execution.
How do I fix CVE-2023-40889?
To fix CVE-2023-40889, upgrade ZBar to versions 0.23.90-1+deb11u1, 0.23.92-7+deb12u1, 0.23.93-5, or 0.23.93-6.
What software is affected by CVE-2023-40889?
CVE-2023-40889 affects ZBar version 0.23.90, which is available through packages on pip and Debian repositories.
What types of attacks can exploit CVE-2023-40889?
CVE-2023-40889 can be exploited through specially crafted QR codes, which when scanned, may lead to an overflow and execution of arbitrary code.
Is it possible to mitigate CVE-2023-40889 without a software update?
Mitigation options without software updates are limited, but you can limit exposure by controlling the input of QR codes from untrusted sources.