Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Mageia 9: 2024-0374 critical: ZBar buffer overflow exploit

mageia
Calendar Grey November 27, 2024
Scroller Mageia
Patch for ZBar addresses urgent vulnerabilities in Mageia 9. Discover details on buffer overflow threats and their remediation.
A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90

Summary

A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner. CVE-2023-40889 A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner. CVE-2023-40890

References

- https://bugs.mageia.org/show_bug.cgi?id=33790

- https://ubuntu.com/security/notices/USN-7118-1

- https://www.cve.org/CVERecord?id=CVE-2023-40889

- https://www.cve.org/CVERecord?id=CVE-2023-40890

Topics%20covered

Topics Covered

security advisory buffer overflow code execution information disclosure Mageia ZBar

Resolution

SRPMS

- 9/core/zbar-0.23.93-1.mga9

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 27 Nov 2024
URL: https://advisories.mageia.org/MGASA-2024-0374.html
Type: security
CVE: CVE-2023-40889, CVE-2023-40890

Topics%20covered

Topics Covered

security advisory buffer overflow code execution information disclosure Mageia ZBar

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.