A vulnerability was found in libzvbi up to 0.2.43. It has been classified as problematic. Affected is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to uninitialized pointer. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as 8def647eea27f7fd7ad33ff79c2d6d3e39948dce. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0988-1 advisory.

    - CVE-2025-2173: Fixed check on src_length to avoid an unitinialized heap read (bsc#1239222).
    - CVE-2025-2174: Fixed integer overflow leading to heap overflow in src/conv.c, src/io-sim.c, src/search.c     (bsc#1239299).
    - CVE-2025-2175: Fixed integer overflow in _vbi_strndup_iconv (bsc#1239312).
    - CVE-2025-2176: Fixed integer overflow in function vbi_capture_sim_load_caption in src/io-sim.c     (bsc#1239319).
    - CVE-2025-2177: Fixed integer overflow in function vbi_search_new in src/search.c (bsc#1239320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7367-1 advisory.

    It was discovered that zvbi incorrectly handled memory when processing user input. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0979-1 advisory.

    - CVE-2025-2173: Fixed check on src_length to avoid an unitinialized heap read (bsc#1239222).
      - CVE-2025-2174: Fixed integer overflow leading to heap overflow in src/conv.c, src/io-sim.c,     src/search.c (bsc#1239299).
      - CVE-2025-2175: Fixed integer overflow in _vbi_strndup_iconv (bsc#1239312).
      - CVE-2025-2176: Fixed integer overflow in function vbi_capture_sim_load_caption in src/io-sim.c     (bsc#1239319).
      - CVE-2025-2177: Fixed integer overflow in function vbi_search_new in src/search.c (bsc#1239320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
233314	SUSE SLES12 Security Update : zvbi (SUSE-SU-2025:0988-1)	Nessus	SuSE Local Security Checks	medium
233301	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : zvbi vulnerabilities (USN-7367-1)	Nessus	Ubuntu Local Security Checks	medium
233205	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : zvbi (SUSE-SU-2025:0979-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2025-2173

medium

Tenable Plugins

medium

medium

medium