Lucene search

K
ubuntucveUbuntu.comUB:CVE-2023-40890
HistoryAug 29, 2023 - 12:00 a.m.

CVE-2023-40890

2023-08-2900:00:00
ubuntu.com
ubuntu.com
6
buffer overflow
zbar
vulnerability
information disclosure
code execution
qr codes
scanner
unix

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

45.5%

A stack-based buffer overflow vulnerability exists in the lookup_sequence
function of ZBar 0.23.90. Specially crafted QR codes may lead to
information disclosure and/or arbitrary code execution. To trigger this
vulnerability, an attacker can digitally input the malicious QR code, or
prepare it to be physically scanned by the vulnerable scanner.

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

45.5%