CVE-2023-40889: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

August 29, 2023 (updated August 30, 2023)

A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.

References

github.com/advisories/GHSA-mhp6-jvpx-2p4m
hackmd.io/@cspl/B1ZkFZv23
nvd.nist.gov/vuln/detail/CVE-2023-40889

Code Behaviors & Features

Detect and mitigate CVE-2023-40889 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →