-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2023.7240
                           zbar security update
                              4 December 2023

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           zbar
Publisher:         Debian
Operating System:  Debian GNU/Linux
Resolution:        Patch/Upgrade
CVE Names:         CVE-2023-40890 CVE-2023-40889 

Original Bulletin: 
   https://lists.debian.org/debian-lts-announce/2023/12/msg00001.html

Comment: CVSS (Max):  9.8 CVE-2023-40890 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
         CVSS Source: NIST
         Calculator:  https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- - -------------------------------------------------------------------------
Debian LTS Advisory DLA-3675-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                   Bastien Roucariès
November 30, 2023                             https://wiki.debian.org/LTS
- - -------------------------------------------------------------------------

Package        : zbar
Version        : 0.22-1+deb10u1
CVE ID         : CVE-2023-40889 CVE-2023-40890
Debian Bug     : 1051724

zbar, a barcode and qrcode scanner was vulnerable.

CVE-2023-40889

    A heap-based buffer overflow existed
    in the qr_reader_match_centers function.
    Specially crafted QR codes may lead to information disclosure
    and/or arbitrary code execution. To trigger this
    vulnerability, an attacker can digitally input the
    malicious QR code, or prepare it to be physically scanned
    by the vulnerable scanner.

CVE-2023-40890

    A stack overflow was present in lookup_sequence
    function. Specially crafted QR codes may lead
    to information disclosure and/or arbitrary code execution.
    To trigger this vulnerability, an attacker can digitally input
    the malicious QR code, or prepare it to be physically scanned
    by the vulnerable scanner.

For Debian 10 buster, these problems have been fixed in version
0.22-1+deb10u1.

We recommend that you upgrade your zbar packages.

For the detailed security status of zbar please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/zbar

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmVptdIACgkQADoaLapB
CF+qkA//ayhq/ZghqFKwFfzntiUBi/o3HpUL0n1M5EC0EsF2hynHCOJcemz4K+xd
33peBYdrSPtL49n5G2xcIg1B+4ouMhUocqYRs3slhJg2s5yx96EzWgFngrNcaiga
Drd/SOuT7L4CO0BVs1SVQaXzRc9OWfTTwk+z3XIqWLeqm82lrnPCXFWZLFuelr2B
SlO4oxdKt3yE0ExdMJTW21iXzzHPspHRIZ/tql7mxP3mbQn807MFk0nvWmDXL8lb
TDsb0BYa26QIC4F4pdF2ZfKH7HE8Qq9Y2D8mE7nMZ2ytVsqSXX5xQM64yNZdeFd9
YTQP+PJCfJmj43Yuic4fsRQm8Y0AgbbxMlYU44OZAWGKHbeYYNiqridRbrpoUaxa
/NOErqIbQKgmS5CGz5q6gDt/PNrCL4KH8vJYJRAywOkDuh+4Qz1zE/6DlSxkLbMr
MOBtpP9AFgeSmg9sJ+09ytnkRJsaDrl8P8NHSs3zF0UTzm3C30iMxFibPQgExA7d
4iAtt34UkRVC4OdrB1xtGXcLr84xMXuQE7fcp9pJR/Z2mSAQAT8LhQ4D/kJpNSLe
UDWJQ933lwg3hbjmRwgqBySAZEzEkSLdiBiktP3Q3z3kILhHq7UCeSD1cTGJYX5k
FQd1a5EYd9WNJDoFEOmR7AaA4RG7NhlWyFchUxxL1gxtgsp8zjU=
=toHR
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/

iQIVAwUBZW03RckNZI30y1K9AQioOg//XYnR1WrzyELTgrEgExUyF9JmuSnSezj6
HXYWzDbxgsCQuceLPKnn/eHoSnE4hIHWe/josg9HxMyksPgQClrWqgWycQjTtt+l
s1O7TAqtc+5o+Z8vTdFAmeliTWoRzaJCFzELXG6cNbtdmhM0K0QAE2UsDgQb2Gi9
yRowB4+zmRdUKmMKmSFzdTUmtLlEElA8DpSP7/+0tu7TKtLRy5VWmlMQHuEXStzT
Jx5GJeuQpHPUrpIFSIFpnjgozRS8ru3kx8VX80Y3xsKGQrQMIvrXcvqDpkcK3w7w
MH7mqqMy4NKc7lbufe1tvKcQ/T/G6cH81HvDrwOINtio+QN3Y4wEzEv2aURsFXM9
VCNUBD8Pz1trusQQsVAsi1JevCWVBwWoCma6pqCcGO5bo7HqwOIOiZqeduHPn32L
Rhdh9YfLJcOhOR3nT02R+jg3DysbIs9/F8+h73ACrCCSghHTHhoUwC6dmPMQwEus
nv3eXKGHlDewej8eMDyj7o1ELFGVzHL2OB+z7lUo6e6nxHtaN8Gk8fWwPcbiCw2Y
x1VNqckZocIlxPM4MbFDnW6pbvhHfqrdPnWYj7DRhRkFfAuNXIPwOJY0C/Q0LKp/
pT4FztkndyR7FNevAzVJa2uJc+HerT66IHECb2xsmTMdAxBq3rHPcWrbV5noZ0HI
+8CUcJI9Ua0=
=3iwb
-----END PGP SIGNATURE-----