CVE catalog
CVE-2023-40890
zbar: CVE-2023-40890
- Severity
- High · CVSS 8.4
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.95% · Oct 25, 2026
A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | zbar | sid | 0.23.95-1 | fixed |
| Debian | zbar | forky | 0.23.93-10 | fixed |
| Debian | zbar | trixie | 0.23.93-8 | fixed |
| Debian | zbar | bookworm | 0.23.92-7+deb12u1 | fixed |
| Debian | zbar | bookworm-security | 0.23.92-7+deb12u1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | zbar | source | sid | 0.23.92-9 | not yet assigned | Not reported | [1051724] |
| Debian | zbar | source | forky | 0.23.92-9 | not yet assigned | Not reported | [1051724] |
| Debian | zbar | source | trixie | 0.23.92-9 | not yet assigned | Not reported | [1051724] |
| Debian | zbar | source | bookworm | 0.23.92-7+deb12u1 | not yet assigned | Not reported | [1051724] |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2023_4948-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2023-40890]
- [https://security-tracker.debian.org/tracker/CVE-2023-40890]
- [https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-40890.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]