CVE catalog
CVE-2023-40889
zbar: CVE-2023-40889
- Severity
- High · CVSS 8.4
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.75% · Oct 25, 2026
A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | zbar | sid | 0.23.95-1 | fixed |
| Debian | zbar | forky | 0.23.93-10 | fixed |
| Debian | zbar | trixie | 0.23.93-8 | fixed |
| Debian | zbar | bookworm | 0.23.92-7+deb12u1 | fixed |
| Debian | zbar | bookworm-security | 0.23.92-7+deb12u1 | fixed |
| Ubuntu | zbar | pro | 0.23.90-1 | vulnerable |
| Ubuntu | zbar | pro | 0.23.92-4 | vulnerable |
| Ubuntu | zbar | pro | 0.23.92-4build2 | vulnerable |
| Ubuntu | zbar | pro | 0.23.92-4ubuntu0.1~esm1 | fixed |
| Opensuse | zbar | tumbleweed | 0.23.90-5.1 | fixed |
| Suse | zbar | linux enterprise module for desktop applications 15 sp5 | 0.23.1-150300.3.3.1 | fixed |
| Suse | zbar | linux enterprise module for package hub 15 sp5 | 0.23.1-150300.3.3.1 | fixed |
| Suse | zbar | linux enterprise real time 15 sp4 | 0.23.1-150300.3.3.1 | fixed |
| Opensuse | zbar | leap 15.4 | 0.23.1-150300.3.3.1 | fixed |
| Opensuse | zbar | leap 15.5 | 0.23.1-150300.3.3.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | zbar | source | sid | 0.23.92-9 | not yet assigned | Not reported | [1051724] |
| Debian | zbar | source | forky | 0.23.92-9 | not yet assigned | Not reported | [1051724] |
| Debian | zbar | source | trixie | 0.23.92-9 | not yet assigned | Not reported | [1051724] |
| Debian | zbar | source | bookworm | 0.23.92-7+deb12u1 | not yet assigned | Not reported | [1051724] |
| Ubuntu | zbar | deb | pro | 0.23.92-4ubuntu0.1~esm1 | Not reported | USN-7118-1 | Not reported |
| Opensuse | zbar | rpm | tumbleweed | 0.23.90-5.1 | Not reported | OPENSUSE-SU-2024:13525-1 | Not reported |
| Suse | zbar | rpm | linux enterprise module for desktop applications 15 sp5 | 0.23.1-150300.3.3.1 | Not reported | SUSE-SU-2023:4948-1 | Not reported |
| Suse | zbar | rpm | linux enterprise module for package hub 15 sp5 | 0.23.1-150300.3.3.1 | Not reported | SUSE-SU-2023:4948-1 | Not reported |
| Suse | zbar | rpm | linux enterprise real time 15 sp4 | 0.23.1-150300.3.3.1 | Not reported | SUSE-SU-2023:4948-1 | Not reported |
| Opensuse | zbar | rpm | leap 15.4 | 0.23.1-150300.3.3.1 | Not reported | SUSE-SU-2023:4948-1 | Not reported |
| Opensuse | zbar | rpm | leap 15.5 | 0.23.1-150300.3.3.1 | Not reported | SUSE-SU-2023:4948-1 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2023_4948-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2023-40889]
- [https://osv.dev/vulnerability/DLA-3675-1]
- [https://osv.dev/vulnerability/DSA-5614-1]
- [https://osv.dev/vulnerability/SUSE-SU-2023:4948-1]
- [https://osv.dev/vulnerability/USN-7118-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:13525-1]
- [https://security-tracker.debian.org/tracker/CVE-2023-40889]
- [https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-40889.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]