{"id":"CVE-2023-40889","aliases":["ALPINE-CVE-2023-40889","DEBIAN-CVE-2023-40889","DLA-3675-1","DSA-5614-1","EUVD-2023-2327","GHSA-mhp6-jvpx-2p4m","MGASA-2024-0374","OESA-2024-1155","OESA-2024-1156","OESA-2024-1157","OESA-2024-1158","PYSEC-2026-576","SUSE-SU-2023:4948-1","UBUNTU-CVE-2023-40889","USN-7118-1","openSUSE-SU-2024:13525-1"],"status":"published","title":"Heap-based buffer overflow in ZBar","description":"A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01748,"percentile":0.7803,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122","CWE-787"],"published":"2023-08-29T00:00:00Z","modified":"2026-11-03T06:32:59Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"zbar","fixed_in":["0.23.93-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"zbar","fixed_in":["0.23.93-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"zbar","fixed_in":["0.23.93-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"zbar","fixed_in":["0.23.93-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"zbar","fixed_in":["0.23.93-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"zbar","fixed_in":["0.23.93-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"zbar","fixed_in":["0.23.92-7+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"zbar","fixed_in":["0.23.92-9"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zbar","fixed_in":["0.23.92-9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zbar","fixed_in":["0.10+doc-10ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"zbar","fixed_in":["0.10+doc-10.1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"zbar","fixed_in":["0.23-1.3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"zbar","fixed_in":["0.23.92-4ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.23.90"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.93-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.93-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.93-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.93-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.93-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.93-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.92-7+deb12u1"}]}],"versions":["0.23.92-7"]},{"source":"osv","ecosystem":"Debian:13","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.92-9"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.92-9"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22-1+deb10u1"}]}],"versions":["0.22-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.90-1+deb11u1"}]}],"versions":["0.23.90-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.92-7+deb12u1"}]}],"versions":["0.23.92-7"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.23.90"}]}],"versions":["0.10"]},{"source":"osv","ecosystem":"Mageia:9","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.93-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.93-1.oe2203sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.93-1.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22-5.oe2203"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.93-1.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.23.90"}]}],"versions":["0.10"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.1-150300.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.1-150300.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP4","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.1-150300.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.1-150300.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.1-150300.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10+doc-9","0.10+doc-9build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10+doc-10ubuntu1+esm1"}]}],"versions":["0.10+doc-10build1","0.10+doc-10build2","0.10+doc-10ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10+doc-10.1ubuntu0.1~esm1"}]}],"versions":["0.10+doc-10.1build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23-1.3ubuntu0.1~esm1"}]}],"versions":["0.23-1.1","0.23-1.2","0.23-1.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.92-4ubuntu0.1~esm1"}]}],"versions":["0.23.90-1","0.23.92-4","0.23.92-4build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.93-7","0.23.93-8"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.93-9ubuntu1","0.23.93-9ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.93-8","0.23.93-9ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10+doc-10ubuntu1+esm1"}]}],"versions":["0.10+doc-10build1","0.10+doc-10build2","0.10+doc-10ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10+doc-10.1ubuntu0.1~esm1"}]}],"versions":["0.10+doc-10.1build2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23-1.3ubuntu0.1~esm1"}]}],"versions":["0.23-1.1","0.23-1.2","0.23-1.3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.92-4ubuntu0.1~esm1"}]}],"versions":["0.23.90-1","0.23.92-4","0.23.92-4build2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.90-5.1"}]}],"bundled":2}],"products":[{"vendor":"zbar_project","product":"zbar"}],"references":[{"url":"https://hackmd.io/%40cspl/B1ZkFZv23","tags":["x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00001.html","tags":["mailing-list","x_transferred","article","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25LZZQJGGZRPLKTRNRNOTAFQJIPS7WRP/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DC7V5YCLCPB36J2KY6WLZCABFLBRB665/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DC7V5YCLCPB36J2KY6WLZCABFLBRB665/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40889","tags":["advisory"]},{"url":"https://hackmd.io/@cspl/B1ZkFZv23","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-mhp6-jvpx-2p4m","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-40889","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40889.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-40889","tags":["advisory"]},{"url":"https://github.com/mchehab/zbar","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25LZZQJGGZRPLKTRNRNOTAFQJIPS7WRP","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DC7V5YCLCPB36J2KY6WLZCABFLBRB665","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2024-0374.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33790","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7118-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1155","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40890","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1156","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1157","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1158","tags":["advisory"]},{"url":"https://pypi.org/project/zbar","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234948-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1214770","tags":["report"]},{"url":"https://bugzilla.suse.com/1214771","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40890","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-40889","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40889","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-40890","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-40889","description":"A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.","status":"published","published":"2023-08-29T00:00:00Z","modified":"2025-11-04T18:16:43.28Z","updated_at":"2026-11-02T14:35:21.971258Z"}],"euvd":[{"id":"EUVD-2023-2327","description":"A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.","status":"published","published":"2023-08-29T00:00:00Z","modified":"2025-11-04T18:16:43Z","updated_at":"2026-11-02T19:49:24.543935Z"}],"ghsa":[{"id":"GHSA-mhp6-jvpx-2p4m","title":"Heap-based buffer overflow in ZBar","description":"A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.","status":"published","published":"2023-08-29T18:31:53Z","modified":"2024-01-19T19:48:28Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-122","CWE-787"],"updated_at":"2026-11-02T14:37:31.550603Z"}],"nvd":[{"id":"CVE-2023-40889","description":"A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.","status":"published","published":"2023-08-29T17:15:12.84Z","modified":"2026-06-17T06:19:48.08Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:08:25.025396Z"}],"osv":[{"id":"ALPINE-CVE-2023-40889","description":"A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.","status":"published","published":"2023-08-29T17:15:12.84Z","modified":"2026-11-03T06:32:59.197350381Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"DEBIAN-CVE-2023-40889","description":"A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.","status":"published","published":"2023-08-29T17:15:12.84Z","modified":"2026-10-26T18:02:32.461929485Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"GHSA-mhp6-jvpx-2p4m","title":"Heap-based buffer overflow in ZBar","description":"A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.","status":"published","published":"2023-08-29T18:31:53Z","modified":"2026-06-29T12:26:35.245224383Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-122","CWE-787"],"updated_at":"2026-11-02T15:46:51.811331Z"},{"id":"OESA-2024-1155","title":"zbar security update","description":"ZBar is an open source software suite for reading bar codes from various sources, such as video streams, image files and raw intensity sensors. It supports many popular symbologies (types of bar codes) including EAN-13/UPC-A, UPC-E, EAN-8, Code 128, Code 39, Interleaved 2 of 5 and QR Code.\r\n\r\nSecurity Fix(es):\r\n\r\nA heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.(CVE-2023-40889)\r\n\r\nA stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.(CVE-2023-40890)","status":"published","published":"2024-02-08T11:06:36Z","modified":"2026-08-18T01:18:15.575520277Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1156","title":"zbar security update","description":"ZBar is an open source software suite for reading bar codes from various sources, such as video streams, image files and raw intensity sensors. It supports many popular symbologies (types of bar codes) including EAN-13/UPC-A, UPC-E, EAN-8, Code 128, Code 39, Interleaved 2 of 5 and QR Code.\r\n\r\nSecurity Fix(es):\r\n\r\nA heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.(CVE-2023-40889)\r\n\r\nA stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.(CVE-2023-40890)","status":"published","published":"2024-02-08T11:06:36Z","modified":"2026-08-18T01:18:15.761195725Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1157","title":"zbar security update","description":"ZBar is an open source software suite for reading bar codes from various sources, such as video streams, image files and raw intensity sensors. It supports many popular symbologies (types of bar codes) including EAN-13/UPC-A, UPC-E, EAN-8, Code 128, Code 39, Interleaved 2 of 5 and QR Code.\r\n\r\nSecurity Fix(es):\r\n\r\nA heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.(CVE-2023-40889)\r\n\r\nA stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.(CVE-2023-40890)","status":"published","published":"2024-02-08T11:06:36Z","modified":"2026-08-18T01:18:15.072961267Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1158","title":"zbar security update","description":"ZBar is an open source software suite for reading bar codes from various sources, such as video streams, image files and raw intensity sensors. It supports many popular symbologies (types of bar codes) including EAN-13/UPC-A, UPC-E, EAN-8, Code 128, Code 39, Interleaved 2 of 5 and QR Code.\r\n\r\nSecurity Fix(es):\r\n\r\nA heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.(CVE-2023-40889)\r\n\r\nA stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.(CVE-2023-40890)","status":"published","published":"2024-02-08T11:06:36Z","modified":"2026-08-18T01:18:15.09791465Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"PYSEC-2026-576","title":"Heap-based buffer overflow in ZBar","description":"A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.","status":"published","published":"2026-06-29T11:50:44.123752Z","modified":"2026-07-01T20:23:12.100943Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:57.671918Z"},{"id":"UBUNTU-CVE-2023-40889","description":"A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.","status":"published","published":"2023-08-29T17:15:00Z","modified":"2026-10-17T12:56:25.824345921Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"CVE-2023-40889","description":"A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.","status":"published","published":"2023-08-29T00:00:00Z","modified":"2026-10-28T02:31:05.778273629Z","updated_at":"2026-11-02T15:44:33.244128Z"},{"id":"DLA-3675-1","title":"zbar - security update","status":"published","published":"2023-11-30T00:00:00Z","modified":"2026-03-09T01:21:10.268488Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5614-1","title":"zbar - security update","status":"published","published":"2024-02-03T00:00:00Z","modified":"2026-03-09T02:10:39.546704Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2024-0374","title":"Updated zbar packages fix security vulnerabilities","description":"A heap-based buffer overflow exists in the qr_reader_match_centers\nfunction of ZBar 0.23.90. Specially crafted QR codes may lead to\ninformation disclosure and/or arbitrary code execution. To trigger this\nvulnerability, an attacker can digitally input the malicious QR code, or\nprepare it to be physically scanned by the vulnerable scanner.\nCVE-2023-40889\nA stack-based buffer overflow vulnerability exists in the\nlookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may\nlead to information disclosure and/or arbitrary code execution. To\ntrigger this vulnerability, an attacker can digitally input the\nmalicious QR code, or prepare it to be physically scanned by the\nvulnerable scanner. CVE-2023-40890\n","status":"published","published":"2024-11-27T19:59:10Z","modified":"2026-04-16T04:42:18.144732688Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13525-1","title":"libzbar-devel-0.23.90-5.1 on GA media","description":"These are all security issues fixed in the libzbar-devel-0.23.90-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:48:12.312791Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2023:4948-1","title":"Security update for zbar","description":"This update for zbar fixes the following issues:\n\n- CVE-2023-40889: Fixed heap-based buffer overflow in the qr_reader_match_centers function (bsc#1214770).\n- CVE-2023-40890: Fixed stack-based buffer overflow in the lookup_sequence function (bsc#1214771).\n","status":"published","published":"2023-12-21T13:12:49Z","modified":"2026-02-04T03:00:58.154438Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"USN-7118-1","title":"zbar vulnerabilities","description":"It was discovered that ZBar did not properly handle certain QR codes. If a\nuser or automated system using ZBar were tricked into opening a specially\ncrafted file, an attacker could possibly use this to obtain sensitive\ninformation.  (CVE-2023-40889)\n\nIt was discovered that ZBar did not properly handle certain QR codes. If a\nuser or automated system using ZBar were tricked into opening a specially\ncrafted file, an attacker could possibly use this to obtain sensitive\ninformation. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04\nLTS. (CVE-2023-40890)\n","status":"published","published":"2024-11-21T12:23:06Z","modified":"2026-06-25T13:32:29.887399321Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}