Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-40890: ZBar 0.23.90 Scanner Vulnerable to Malicious QR Code Attacks

CVE-2023-40890 · published 3 years ago

Summary

A malicious QR code can cause a vulnerable ZBar scanner to reveal sensitive information or run unauthorized code. This is a serious issue if you use ZBar to scan QR codes, especially if you're scanning codes from unknown sources. Update to the latest version of ZBar to fix this vulnerability.

What to do

Update canonical zbar to version 0.23-1.3ubuntu0.1~esm1.
Update canonical zbar to version 0.23.92-4ubuntu0.1~esm1.
Update debian zbar to version 0.23.92-7+deb12u1.
Update debian zbar to version 0.23.92-9.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	zbar_project	zbar	0.23.90 `cpe:2.3:a:zbar_project:zbar:0.23.90:::::::*`
Ubuntu:Pro:20.04:LTS	canonical	zbar	< 0.23-1.3ubuntu0.1~esm1 Fix: upgrade to 0.23-1.3ubuntu0.1~esm1
Ubuntu:Pro:22.04:LTS	canonical	zbar	< 0.23.92-4ubuntu0.1~esm1 Fix: upgrade to 0.23.92-4ubuntu0.1~esm1
Ubuntu:25.10	canonical	zbar	All versions
Debian:12	debian	zbar	< 0.23.92-7+deb12u1 Fix: upgrade to 0.23.92-7+deb12u1
Debian:13	debian	zbar	< 0.23.92-9 Fix: upgrade to 0.23.92-9

Original advisory text

A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.

References

https://hackmd.io/%40cspl/H1PxPAUnn URL
https://lists.debian.org/debian-lts-announce/2023/12/msg00001.html Third Party Advisory
https://ubuntu.com/security/CVE-2023-40890 Third Party Advisory
https://hackmd.io/@cspl/H1PxPAUnn Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-40890 Third Party Advisory
https://ubuntu.com/security/notices/USN-7118-1 Vendor Advisory
https://lists.fedoraproject.org/archives/list/[email protected]... URL
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40890... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-40890 Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2023-40890 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

2% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published29 Aug 2023

Updated4 Nov 2026

First seen2 Apr 2026

Sources

CVE-2023-40890 · OSV

CVE-2023-40890 · NVD

UBUNTU-CVE-2023-40890 · OSV

DEBIAN-CVE-2023-40890 · OSV

Track software like this

Free during beta