{"id":"CVE-2025-2175","aliases":["DEBIAN-CVE-2025-2175","DLA-4449-1","EUVD-2025-7528","GHSA-c5fh-wq58-2973","GHSA-g7cg-7gw9-v8cf","MGASA-2025-0121","OESA-2025-1330","OESA-2025-1353","OESA-2025-1354","OESA-2025-1355","OESA-2025-2073","ROOT-OS-DEBIAN-12-CVE-2025-2175","SUSE-SU-2025:0979-1","SUSE-SU-2025:0988-1","UBUNTU-CVE-2025-2175","USN-7367-1","openSUSE-SU-2025:14891-1"],"status":"published","title":"libzvbi _vbi_strndup_iconv integer overflow","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.0062,"percentile":0.50005,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-189","CWE-190","CWE-824","CWE-908"],"published":"2025-03-11T06:31:05.166Z","modified":"2026-10-28T10:59:19Z","fixes":[{"ecosystem":"Debian:12","package":"zvbi","fixed_in":["0.2.41-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"zvbi","fixed_in":["0.2.44-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zvbi","fixed_in":["0.2.44-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"zvbi","fixed_in":["0.2.44-1.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"zvbi","fixed_in":["0.2.44-1.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"zvbi","fixed_in":["0.2.35-10.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zvbi","fixed_in":["0.2.35-10ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"zvbi","fixed_in":["0.2.35-13ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"zvbi","fixed_in":["0.2.35-17ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"zvbi","fixed_in":["0.2.35-19ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"zvbi","fixed_in":["0.2.42-2ubuntu0.24.04.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.41-1+deb12u1"}]}],"versions":["0.2.41-1"]},{"source":"osv","ecosystem":"Debian:13","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.44-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.44-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-18+deb11u1"}]}],"versions":["0.2.35-18"],"bundled":5},{"source":"osv","ecosystem":"Mageia:9","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.44-1.mga9"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.44-1.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.44-1.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.44-1.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.44-1.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-10.oe2003sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-150000.4.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-150000.4.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-150000.4.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-150000.4.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-150000.4.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-150000.4.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-150000.4.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-150000.4.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-150000.4.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-150000.4.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-150000.4.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.33-7","0.2.35-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-10ubuntu0.1~esm1"}]}],"versions":["0.2.35-9","0.2.35-10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-13ubuntu0.1~esm1"}]}],"versions":["0.2.35-13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-17ubuntu0.1~esm1"}]}],"versions":["0.2.35-16","0.2.35-17"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-19ubuntu0.1~esm1"}]}],"versions":["0.2.35-18","0.2.35-19"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.42-2ubuntu0.24.04.1~esm1"}]}],"versions":["0.2.41-2","0.2.42-1","0.2.42-1.1","0.2.42-1.2","0.2.42-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-10ubuntu0.1~esm1"}]}],"versions":["0.2.35-9","0.2.35-10"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-13ubuntu0.1~esm1"}]}],"versions":["0.2.35-13"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-17ubuntu0.1~esm1"}]}],"versions":["0.2.35-16","0.2.35-17"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.35-19ubuntu0.1~esm1"}]}],"versions":["0.2.35-18","0.2.35-19"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.42-2ubuntu0.24.04.1~esm1"}]}],"versions":["0.2.41-2","0.2.42-1","0.2.42-1.1","0.2.42-1.2","0.2.42-2"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"zvbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.44-1.1"}]}],"bundled":5}],"products":[{"vendor":"zapping-vbi","product":"zvbi"}],"references":[{"url":"https://vuldb.com/?id.299204","tags":["vdb-entry","technical-description","Third Party Advisory","VDB Entry","advisory","report"]},{"url":"https://vuldb.com/?ctiid.299204","tags":["signature","permissions-required","Permissions Required","VDB Entry","report"]},{"url":"https://vuldb.com/?submit.512801","tags":["third-party-advisory","Third Party Advisory","VDB Entry","advisory","report"]},{"url":"https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","tags":["related","Patch","Vendor Advisory","advisory","report"]},{"url":"https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","tags":["patch","Release Notes","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2175","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c5fh-wq58-2973"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2173.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2173","tags":["advisory"]},{"url":"https://vuldb.com/?id.299202","tags":["advisory"]},{"url":"https://vuldb.com/?submit.512798","tags":["advisory"]},{"url":"https://vuldb.com/?ctiid.299202","tags":["report"]},{"url":"https://github.com/zapping-vbi/zvbi/commit/8def647eea27f7fd7ad33ff79c2d6d3e39948dce","tags":["fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2174.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2174","tags":["advisory"]},{"url":"https://vuldb.com/?id.299203","tags":["advisory"]},{"url":"https://vuldb.com/?submit.512800","tags":["advisory"]},{"url":"https://vuldb.com/?ctiid.299203","tags":["report"]},{"url":"https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","tags":["fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2175.json","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2176.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2176","tags":["advisory"]},{"url":"https://vuldb.com/?id.299205","tags":["advisory"]},{"url":"https://vuldb.com/?submit.512802","tags":["advisory"]},{"url":"https://vuldb.com/?ctiid.299205","tags":["report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2177.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2177","tags":["advisory"]},{"url":"https://vuldb.com/?id.299206","tags":["advisory"]},{"url":"https://vuldb.com/?submit.512803","tags":["advisory"]},{"url":"https://vuldb.com/?ctiid.299206","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-2175","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0121.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34136","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7367-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1330","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1353","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1354","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1355","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2073","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250979-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1239222","tags":["report"]},{"url":"https://bugzilla.suse.com/1239299","tags":["report"]},{"url":"https://bugzilla.suse.com/1239312","tags":["report"]},{"url":"https://bugzilla.suse.com/1239319","tags":["report"]},{"url":"https://bugzilla.suse.com/1239320","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2175","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2177","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250988-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-2175","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-2175","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-2173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-2174","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-2176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-2177","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WFNCETNVIFNZJ7PHLDDOO6PDYU27Q6MM/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-2175","title":"libzvbi _vbi_strndup_iconv integer overflow","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.","status":"published","published":"2025-03-11T07:00:09.753Z","modified":"2025-03-11T17:13:11.689Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"},{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","assessor":"cna"}],"cwes":["CWE-190","CWE-189"],"updated_at":"2026-11-02T14:32:39.039362Z"}],"euvd":[{"id":"EUVD-2025-7528","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.","status":"published","published":"2025-03-11T07:00:09Z","modified":"2025-03-11T17:13:11Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:53:07.365753Z"}],"ghsa":[{"id":"GHSA-c5fh-wq58-2973","title":"A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by...","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.","status":"published","published":"2025-03-11T09:30:31Z","modified":"2025-10-03T00:32:06Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:03:50.770325Z"}],"nvd":[{"id":"CVE-2025-2175","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.","status":"published","published":"2025-03-11T07:15:37.44Z","modified":"2026-06-17T09:06:28.243Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"secondary"}],"cwes":["CWE-189","CWE-190"],"updated_at":"2026-11-02T14:10:53.93104Z"}],"osv":[{"id":"CVE-2025-2173","title":"libzvbi conv.c vbi_strndup_iconv_ucs2 uninitialized pointer","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been classified as problematic. Affected is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to uninitialized pointer. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as 8def647eea27f7fd7ad33ff79c2d6d3e39948dce. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.","status":"published","published":"2025-03-11T06:31:05.166Z","modified":"2026-10-28T10:59:19.061517083Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-824","CWE-908"],"updated_at":"2026-11-02T15:44:46.665428Z"},{"id":"CVE-2025-2174","title":"libzvbi conv.c vbi_strndup_iconv_ucs2 integer overflow","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been declared as problematic. Affected by this vulnerability is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to integer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is named ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.","status":"published","published":"2025-03-11T06:31:06.971Z","modified":"2026-10-28T02:30:54.834701305Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-189","CWE-190"],"updated_at":"2026-11-02T15:44:46.665428Z"},{"id":"CVE-2025-2175","title":"libzvbi _vbi_strndup_iconv integer overflow","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.","status":"published","published":"2025-03-11T07:00:09.753Z","modified":"2026-10-28T02:31:09.276967942Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-189","CWE-190"],"updated_at":"2026-11-02T15:44:46.665428Z"},{"id":"CVE-2025-2176","title":"libzvbi io-sim.c vbi_capture_sim_load_caption integer overflow","description":"A vulnerability classified as critical has been found in libzvbi up to 0.2.43. This affects the function vbi_capture_sim_load_caption of the file src/io-sim.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The identifier of the patch is ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.","status":"published","published":"2025-03-11T07:31:05.09Z","modified":"2026-10-28T02:30:54.054125143Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-189","CWE-190"],"updated_at":"2026-11-02T15:44:46.665428Z"},{"id":"CVE-2025-2177","title":"libzvbi search.c vbi_search_new integer overflow","description":"A vulnerability classified as critical was found in libzvbi up to 0.2.43. This vulnerability affects the function vbi_search_new of the file src/search.c. The manipulation of the argument pat_len leads to integer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.","status":"published","published":"2025-03-11T07:31:06.438Z","modified":"2026-10-28T02:30:28.962231845Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-189","CWE-190"],"updated_at":"2026-11-02T15:44:46.665428Z"},{"id":"DEBIAN-CVE-2025-2175","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.","status":"published","published":"2025-03-11T07:15:37.44Z","modified":"2026-09-01T20:05:42.225885591Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:45.524682Z"},{"id":"OESA-2025-1330","title":"zvbi security update","description":"The ZVBI library provides functions to read from Linux V4L, V4L2 and FreeBSD BKTR raw VBI capture devices, from Linux DVB devices and from a VBI proxy to share V4L and V4L2 VBI devices between multiple applications. It can demodulate raw to sliced VBI data in software, with support for a wide range of formats, has functions to decode several popular services including Teletext and Closed Caption, a Teletext cache with search function, various text export and rendering functions.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in libzvbi up to 0.2.43. It has been classified as problematic. Affected is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to uninitialized pointer. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as 8def647eea27f7fd7ad33ff79c2d6d3e39948dce. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.(CVE-2025-2173)\n\nA vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.(CVE-2025-2175)","status":"published","published":"2025-03-29T11:08:25Z","modified":"2026-08-18T01:18:49.891659417Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1353","title":"zvbi security update","description":"The ZVBI library provides functions to read from Linux V4L, V4L2 and FreeBSD BKTR raw VBI capture devices, from Linux DVB devices and from a VBI proxy to share V4L and V4L2 VBI devices between multiple applications. It can demodulate raw to sliced VBI data in software, with support for a wide range of formats, has functions to decode several popular services including Teletext and Closed Caption, a Teletext cache with search function, various text export and rendering functions.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in libzvbi up to 0.2.43. It has been classified as problematic. Affected is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to uninitialized pointer. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as 8def647eea27f7fd7ad33ff79c2d6d3e39948dce. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.(CVE-2025-2173)\n\nA vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.(CVE-2025-2175)","status":"published","published":"2025-04-03T11:08:27Z","modified":"2026-08-18T01:17:51.035874931Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1354","title":"zvbi security update","description":"The ZVBI library provides functions to read from Linux V4L, V4L2 and FreeBSD BKTR raw VBI capture devices, from Linux DVB devices and from a VBI proxy to share V4L and V4L2 VBI devices between multiple applications. It can demodulate raw to sliced VBI data in software, with support for a wide range of formats, has functions to decode several popular services including Teletext and Closed Caption, a Teletext cache with search function, various text export and rendering functions.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.(CVE-2025-2175)","status":"published","published":"2025-04-03T11:08:27Z","modified":"2026-08-18T01:17:50.660809653Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1355","title":"zvbi security update","description":"The ZVBI library provides functions to read from Linux V4L, V4L2 and FreeBSD BKTR raw VBI capture devices, from Linux DVB devices and from a VBI proxy to share V4L and V4L2 VBI devices between multiple applications. It can demodulate raw to sliced VBI data in software, with support for a wide range of formats, has functions to decode several popular services including Teletext and Closed Caption, a Teletext cache with search function, various text export and rendering functions.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.(CVE-2025-2175)","status":"published","published":"2025-04-03T11:08:27Z","modified":"2026-08-18T01:17:51.033186896Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-2073","title":"zvbi security update","description":"The ZVBI library provides functions to read from Linux V4L, V4L2 and FreeBSD BKTR raw VBI capture devices, from Linux DVB devices and from a VBI proxy to share V4L and V4L2 VBI devices between multiple applications. It can demodulate raw to sliced VBI data in software, with support for a wide range of formats, has functions to decode several popular services including Teletext and Closed Caption, a Teletext cache with search function, various text export and rendering functions.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.(CVE-2025-2175)","status":"published","published":"2025-08-22T11:09:09Z","modified":"2026-08-18T01:18:08.298146726Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"UBUNTU-CVE-2025-2175","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.","status":"published","published":"2025-03-11T07:15:00Z","modified":"2026-04-22T15:35:12.642722Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:22.579335Z"},{"id":"DLA-4449-1","title":"zvbi - security update","status":"published","published":"2026-01-24T00:00:00Z","modified":"2026-01-24T19:29:54.367891Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2025-0121","title":"Updated zvbi packages fix security vulnerabilities","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been\nclassified as problematic. Affected is the function\nvbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the\nargument src_length leads to uninitialized pointer. It is possible to\nlaunch the attack remotely. The exploit has been disclosed to the public\nand may be used. Upgrading to version 0.2.44 is able to address this\nissue (CVE-2025-2173).\nA vulnerability classified as critical has been found in libzvbi up to\n0.2.43. This affects the function vbi_capture_sim_load_caption of the\nfile src/io-sim.c. The manipulation leads to integer overflow. It is\npossible to initiate the attack remotely. The exploit has been disclosed\nto the public and may be used. Upgrading to version 0.2.44 is able to\naddress this issue(A vulnerability classified as critical has been found\nin libzvbi up to 0.2.43. This affects the function\nvbi_capture_sim_load_caption of the file src/io-sim.c. The manipulation\nleads to integer overflow. It is possible to initiate the attack\nremotely. The exploit has been disclosed to the public and may be used.\nUpgrading to version 0.2.44 is able to address this\nissue (CVE-2025-2176).\nA vulnerability was found in libzvbi up to 0.2.43. It has been rated as\nproblematic. Affected by this issue is the function _vbi_strndup_iconv.\nThe manipulation leads to integer overflow. The attack may be launched\nremotely. The exploit has been disclosed to the public and may be used.\nUpgrading to version 0.2.44 is able to address this\nissue (CVE-2025-2175).\nA vulnerability classified as critical was found in libzvbi up to\n0.2.43. This vulnerability affects the function vbi_search_new of the\nfile src/search.c. The manipulation of the argument pat_len leads to\ninteger overflow. The attack can be initiated remotely. The exploit has\nbeen disclosed to the public and may be used. Upgrading to version\n0.2.44 is able to address this issue (CVE-2025-2177)\nA vulnerability was found in libzvbi up to 0.2.43. It has been declared\nas problematic. Affected by this vulnerability is the function\nvbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the\nargument src_length leads to integer overflow. The attack can be\nlaunched remotely. The exploit has been disclosed to the public and may\nbe used. Upgrading to version 0.2.44 is able to address this\nissue (CVE-2025-2174).\n","status":"published","published":"2025-03-31T15:54:01Z","modified":"2026-04-16T04:42:32.041630042Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:14891-1","title":"libzvbi-chains0-0.2.44-1.1 on GA media","description":"These are all security issues fixed in the libzvbi-chains0-0.2.44-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-13T00:00:00Z","modified":"2026-02-04T04:20:15.694482Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2025-2175","title":"CVE-2025-2175 in rootio-zvbi - Patched by Root","description":"Root has patched CVE-2025-2175 in the rootio-zvbi package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2025-08-12T08:24:43Z","modified":"2026-08-27T14:00:06.310891756Z","updated_at":"2026-11-02T15:53:30.983521Z"},{"id":"SUSE-SU-2025:0979-1","title":"Security update for zvbi","description":"This update for zvbi fixes the following issues:\n  \n  - CVE-2025-2173: Fixed check on src_length to avoid an unitinialized heap read (bsc#1239222).\n  - CVE-2025-2174: Fixed integer overflow leading to heap overflow in src/conv.c, src/io-sim.c, src/search.c (bsc#1239299).\n  - CVE-2025-2175: Fixed integer overflow in _vbi_strndup_iconv (bsc#1239312).\n  - CVE-2025-2176: Fixed integer overflow in function vbi_capture_sim_load_caption in src/io-sim.c (bsc#1239319).\n  - CVE-2025-2177: Fixed integer overflow in function vbi_search_new in src/search.c (bsc#1239320).\n","status":"published","published":"2025-03-21T12:54:02Z","modified":"2026-02-04T03:05:00.210824Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:0988-1","title":"Security update for zvbi","description":"This update for zvbi fixes the following issues:\n  \n- CVE-2025-2173: Fixed check on src_length to avoid an unitinialized heap read (bsc#1239222).\n- CVE-2025-2174: Fixed integer overflow leading to heap overflow in src/conv.c, src/io-sim.c, src/search.c (bsc#1239299).\n- CVE-2025-2175: Fixed integer overflow in _vbi_strndup_iconv (bsc#1239312).\n- CVE-2025-2176: Fixed integer overflow in function vbi_capture_sim_load_caption in src/io-sim.c (bsc#1239319).\n- CVE-2025-2177: Fixed integer overflow in function vbi_search_new in src/search.c (bsc#1239320).\n","status":"published","published":"2025-03-24T09:32:22Z","modified":"2026-02-04T04:11:51.517939Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"USN-7367-1","title":"zvbi vulnerabilities","description":"It was discovered that zvbi incorrectly handled memory when processing user\ninput. An attacker could possibly use this issue to cause a denial of\nservice or execute arbitrary code.\n","status":"published","published":"2025-03-24T12:57:37Z","modified":"2026-06-25T13:32:30.253964425Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}