CVE-2023-40889

Name	CVE-2023-40889
Description	A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3675-1, DSA-5614-1
Debian Bugs	1051724

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
zbar (PTS)	bullseye (security), bullseye	0.23.90-1+deb11u1	fixed
	bookworm, bookworm (security)	0.23.92-7+deb12u1	fixed
	sid, trixie	0.23.93-6	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
zbar	source	buster	0.22-1+deb10u1	DLA-3675-1
zbar	source	bullseye	0.23.90-1+deb11u1	DSA-5614-1
zbar	source	bookworm	0.23.92-7+deb12u1	DSA-5614-1
zbar	source	(unstable)	0.23.92-9		1051724

Notes

https://hackmd.io/@cspl/B1ZkFZv23
https://github.com/mchehab/zbar/issues/263
https://github.com/mchehab/zbar/pull/276
https://github.com/mchehab/zbar/commit/f8f8f5ccf1e8d68c3700e0f0b3d895cdf03ce679