🛡️ MGASA-2024-0374 — zbar (CVE-2023-40889 +1 more)

Updated zbar packages fix security vulnerabilities

A heap-based buffer overflow exists in the qr_reader_match_centers

function of ZBar 0.23.90. Specially crafted QR codes may lead to

information disclosure and/or arbitrary code execution. To trigger this

vulnerability, an attacker can digitally input the malicious QR code, or

prepare it to be physically scanned by the vulnerable scanner.

CVE-2023-40889

A stack-based buffer overflow vulnerability exists in the

lookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may

lead to information disclosure and/or arbitrary code execution. To

trigger this vulnerability, an attacker can digitally input the

malicious QR code, or prepare it to be physically scanned by the

vulnerable scanner. CVE-2023-40890