Log in Start free

Vulnerability · Published Aug 29, 2023 · Assigned by mitre

CVE-2023-40889

Critical 9.8

In plain English

A critical-severity security flaw in the zbar package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)1.7%top 22.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20zbar0.23.93-r0ALPINE-CVE-2023-40889
Alpine:v3.21zbar0.23.93-r0ALPINE-CVE-2023-40889
Alpine:v3.22zbar0.23.93-r0ALPINE-CVE-2023-40889
Alpine:v3.23zbar0.23.93-r0ALPINE-CVE-2023-40889
Alpine:v3.24zbar0.23.93-r0ALPINE-CVE-2023-40889
Debian:12zbar0.23.92-7+deb12u1DEBIAN-CVE-2023-40889
Debian:12zbar0.23.92-7+deb12u1DSA-5614-1
Debian:13zbar0.23.92-9DEBIAN-CVE-2023-40889
Debian:14zbar0.23.92-9DEBIAN-CVE-2023-40889
PyPIzbarno fix listedPYSEC-2026-576
PyPIzbarno fix listedGHSA-mhp6-jvpx-2p4m
Ubuntu:25.10zbarno fix listedUBUNTU-CVE-2023-40889
Ubuntu:26.04:LTSzbarno fix listedUBUNTU-CVE-2023-40889
Ubuntu:26.10zbarno fix listedUBUNTU-CVE-2023-40889

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References