Bug 1214770 (CVE-2023-40889) - VUL-0: CVE-2023-40889: zbar: heap-based buffer overflow exists in the qr_reader_match_centers function
Summary: VUL-0: CVE-2023-40889: zbar: heap-based buffer overflow exists in the qr_read...
Status: RESOLVED FIXED
Alias: CVE-2023-40889
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/376616/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-40889:5.1:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-08-30 06:44 UTC by Alexander Bergmann
Modified: 2024-05-29 12:19 UTC (History)
8 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
POC (2.27 KB, image/png)
2023-12-15 08:29 UTC, Michael Vetter 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2023-08-30 06:44:46 UTC 
CVE-2023-40889

A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.

https://hackmd.io/@cspl/B1ZkFZv23

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-40889
https://bugzilla.redhat.com/show_bug.cgi?id=2235861
https://www.cve.org/CVERecord?id=CVE-2023-40889
https://hackmd.io/@cspl/B1ZkFZv23
Comment 1 Alexander Bergmann 2023-08-30 06:45:38 UTC 
There is no upstream commit reference. Waiting for information here:

https://github.com/mchehab/zbar/issues/263
Comment 2 Petr Gajdos 2023-09-08 09:11:07 UTC 
No change in upstream bug.
Comment 5 Petr Gajdos 2023-10-12 13:22:18 UTC 
No news in upstream bug.
Comment 9 Michael Vetter 2023-12-15 08:29:28 UTC 
Created attachment 871376 [details]
POC

I asked the CVE reporters to send me the POC or publish it, since it was private up to know. I attached it to the bug and they updated their blogpost to include it as well.
Comment 13 Maintenance Automation 2023-12-22 08:30:26 UTC 
SUSE-SU-2023:4948-1: An update that solves two vulnerabilities can now be installed.

Category: security (moderate)
Bug References: 1214770, 1214771
CVE References: CVE-2023-40889, CVE-2023-40890
Sources used:
openSUSE Leap 15.3 (src): zbar-0.23.1-150300.3.3.1
openSUSE Leap 15.4 (src): zbar-0.23.1-150300.3.3.1
openSUSE Leap 15.5 (src): zbar-0.23.1-150300.3.3.1
Desktop Applications Module 15-SP5 (src): zbar-0.23.1-150300.3.3.1
SUSE Package Hub 15 15-SP5 (src): zbar-0.23.1-150300.3.3.1
SUSE Linux Enterprise Real Time 15 SP4 (src): zbar-0.23.1-150300.3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 17 Robert Frohl 2024-05-29 12:19:17 UTC 
done, closing