There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially
    crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this
    vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically
    scanned by the vulnerable scanner. (CVE-2023-40889)

  - A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90.
    Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger
    this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically
    scanned by the vulnerable scanner. (CVE-2023-40890)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-73d5220ed3 advisory.

    0.23.93, fixes for two CVEs

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5614 advisory.

  - A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially     crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this     vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically     scanned by the vulnerable scanner. (CVE-2023-40889)

  - A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90.
    Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger     this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically     scanned by the vulnerable scanner. (CVE-2023-40890)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3675 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3675-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     November 30, 2023                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : zbar     Version        : 0.22-1+deb10u1     CVE ID         : CVE-2023-40889 CVE-2023-40890     Debian Bug     : 1051724

    zbar, a barcode and qrcode scanner was vulnerable.

    CVE-2023-40889

        A heap-based buffer overflow existed         in the qr_reader_match_centers function.
        Specially crafted QR codes may lead to information disclosure         and/or arbitrary code execution. To trigger this         vulnerability, an attacker can digitally input the         malicious QR code, or prepare it to be physically scanned         by the vulnerable scanner.

    CVE-2023-40890

        A stack overflow was present in lookup_sequence         function. Specially crafted QR codes may lead         to information disclosure and/or arbitrary code execution.
        To trigger this vulnerability, an attacker can digitally input         the malicious QR code, or prepare it to be physically scanned         by the vulnerable scanner.

    For Debian 10 buster, these problems have been fixed in version     0.22-1+deb10u1.

    We recommend that you upgrade your zbar packages.

    For the detailed security status of zbar please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/zbar

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4948-1 advisory.

    - CVE-2023-40889: Fixed heap-based buffer overflow in the qr_reader_match_centers function (bsc#1214770).
    - CVE-2023-40890: Fixed stack-based buffer overflow in the lookup_sequence function (bsc#1214771).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially     crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this     vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically     scanned by the vulnerable scanner. (CVE-2023-40889)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-583e4098b9 advisory.

    0.23.93, fixes for two CVEs

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7118-1 advisory.

    It was discovered that ZBar did not properly handle certain QR codes. If a user or automated system using     ZBar were tricked into opening a specially crafted file, an attacker could possibly use this to obtain     sensitive information.

    (CVE-2023-40889)

    It was discovered that ZBar did not properly handle certain QR codes. If a user or automated system using     ZBar were tricked into opening a specially crafted file, an attacker could possibly use this to obtain     sensitive information. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-40890)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
426269	Alpine: multiple libzbar packages, multiple zbar packages, py3-zbar: security update to 0.23.93-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	5/16/2025	7/2/2026	critical
426269	Alpine: multiple libzbar packages, multiple zbar packages, py3-zbar: security update to 0.23.93-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	5/16/2025	7/2/2026	critical
189159	Fedora 39 : zbar (2024-73d5220ed3)	Nessus	Fedora Local Security Checks	1/18/2024	11/14/2024	critical
189975	Debian dsa-5614 : gir1.2-zbar-1.0 - security update	Nessus	Debian Local Security Checks	2/3/2024	2/10/2024	critical
186540	Debian dla-3675 : libbarcode-zbar-perl - security update	Nessus	Debian Local Security Checks	12/4/2023	1/22/2025	critical
187275	SUSE SLED15: libzbar-devel / libzbar0 / libzbar0-32bit / libzbarqt-devel / etc (SUSE-SU-2023:4948-1)	Nessus	SuSE Local Security Checks	12/23/2023	6/25/2026	critical
256121	Linux Distros Unpatched Vulnerability : CVE-2023-40889	Nessus	Misc.	8/27/2025	7/12/2026	critical
189160	Fedora 38 : zbar (2024-583e4098b9)	Nessus	Fedora Local Security Checks	1/18/2024	11/14/2024	critical
211736	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : ZBar vulnerabilities (USN-7118-1)	Nessus	Ubuntu Local Security Checks	11/22/2024	9/3/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical