openEuler 22.03 LTS SP2 update for zbar
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2023-40889 CVE-2023-40890 |
| CWE-ID | CWE-122 CWE-121 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
openEuler Operating systems & Components / Operating system zbar-libs Operating systems & Components / Operating system package or component zbar-debuginfo Operating systems & Components / Operating system package or component zbar-gtk-devel Operating systems & Components / Operating system package or component zbar-devel Operating systems & Components / Operating system package or component zbar-gtk Operating systems & Components / Operating system package or component zbar-qt-devel Operating systems & Components / Operating system package or component zbar-debugsource Operating systems & Components / Operating system package or component python3-zbar Operating systems & Components / Operating system package or component zbar-qt Operating systems & Components / Operating system package or component zbar Operating systems & Components / Operating system package or component |
| Vendor | openEuler |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Heap-based buffer overflow
EUVDB-ID: #VU83882
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2023-40889
CWE-ID:
CWE-122 - Heap-based Buffer Overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the qr_reader_match_centers() function. A remote attacker can trick the victim into scanning a specially crafted barcode, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS SP2
zbar-libs: before 0.23.93-1
zbar-debuginfo: before 0.23.93-1
zbar-gtk-devel: before 0.23.93-1
zbar-devel: before 0.23.93-1
zbar-gtk: before 0.23.93-1
zbar-qt-devel: before 0.23.93-1
zbar-debugsource: before 0.23.93-1
python3-zbar: before 0.23.93-1
zbar-qt: before 0.23.93-1
zbar: before 0.23.93-1
CPE2.3- cpe:2.3:o:openeuler:openeuler:22.03:LTS SP2:*:*:*:*:*:*
- cpe:2.3:a:openeuler:zbar-libs:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:zbar-debuginfo:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:zbar-gtk-devel:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:zbar-devel:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:zbar-gtk:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:zbar-qt-devel:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:zbar-debugsource:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:python3-zbar:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:zbar-qt:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:zbar:*:*:*:*:*:openeuler:*:*
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1155
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Stack-based buffer overflow
EUVDB-ID: #VU83883
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2023-40890
CWE-ID:
CWE-121 - Stack-based buffer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the lookup_sequence() function. A remote attacker can trick the victim to scan a specially crafted barcode, trigger a stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS SP2
zbar-libs: before 0.23.93-1
zbar-debuginfo: before 0.23.93-1
zbar-gtk-devel: before 0.23.93-1
zbar-devel: before 0.23.93-1
zbar-gtk: before 0.23.93-1
zbar-qt-devel: before 0.23.93-1
zbar-debugsource: before 0.23.93-1
python3-zbar: before 0.23.93-1
zbar-qt: before 0.23.93-1
zbar: before 0.23.93-1
CPE2.3- cpe:2.3:o:openeuler:openeuler:22.03:LTS SP2:*:*:*:*:*:*
- cpe:2.3:a:openeuler:zbar-libs:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:zbar-debuginfo:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:zbar-gtk-devel:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:zbar-devel:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:zbar-gtk:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:zbar-qt-devel:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:zbar-debugsource:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:python3-zbar:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:zbar-qt:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:zbar:*:*:*:*:*:openeuler:*:*
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1155
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
