A vulnerability classified as critical was found in libzvbi up to 0.2.43. This vulnerability affects the function vbi_search_new of the file src/search.c. The manipulation of the argument pat_len leads to integer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004963 advisory.

    A vulnerability classified as critical was found in libzvbi up to 0.2.43. This vulnerability affects the     function vbi_search_new of the file src/search.c. The manipulation of the argument pat_len leads to     integer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and     may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as     ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code     maintainer was informed beforehand about the issues. She reacted very fast and highly professional.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4449 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4449-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     January 24, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : zvbi     Version        : 0.2.35-18+deb11u1     CVE ID         : CVE-2025-2173 CVE-2025-2174 CVE-2025-2175 CVE-2025-2176                      CVE-2025-2177


    Several issues have been found in zvbi, a Vertical Blanking Interval     decoder.
    CVE-2025-2173 is related to an uninitialized pointer in src/conv.c::
    vbi_strndup_iconv_ucs2()     The other issues are related to integer overflows in several functions     distributed all over the code.



    For Debian 11 bullseye, these problems have been fixed in version     0.2.35-18+deb11u1.

    We recommend that you upgrade your zvbi packages.

    For the detailed security status of zvbi please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/zvbi

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0222 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-2177:
    A vulnerability classified as critical was found in libzvbi up to 0.2.43. This vulnerability affects the     function vbi_search_new of the file src/search.c. The manipulation of the argument pat_len leads to     integer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and     may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as     ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code     maintainer was informed beforehand about the issues. She reacted very fast and highly professional.

    CVE-2025-2176:
    A vulnerability classified as critical has been found in libzvbi up to 0.2.43. This affects the function     vbi_capture_sim_load_caption of the file src/io-sim.c. The manipulation leads to integer overflow. It is     possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
    Upgrading to version 0.2.44 is able to address this issue. The identifier of the patch is     ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code     maintainer was informed beforehand about the issues. She reacted very fast and highly professional.

    CVE-2025-2175:
    A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this     issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be     launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version     0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code     maintainer was informed beforehand about the issues. She reacted very fast and highly professional.

    CVE-2025-2174:
    A vulnerability was found in libzvbi up to 0.2.43. It has been declared as problematic. Affected by this     vulnerability is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the     argument src_length leads to integer overflow. The attack can be launched remotely. The exploit has been     disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The     patch is named ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected     component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly     professional.

    CVE-2025-2173:
    A vulnerability was found in libzvbi up to 0.2.43. It has been classified as problematic. Affected is the     function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads     to uninitialized pointer. It is possible to launch the attack remotely. The exploit has been disclosed to     the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is     identified as 8def647eea27f7fd7ad33ff79c2d6d3e39948dce. It is recommended to upgrade the affected     component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly     professional.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability classified as critical was found in libzvbi up to 0.2.43. This vulnerability affects the     function vbi_search_new of the file src/search.c. The manipulation of the argument pat_len leads to     integer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and     may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as     ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code     maintainer was informed beforehand about the issues. She reacted very fast and highly professional.
    (CVE-2025-2177)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0988-1 advisory.

    - CVE-2025-2173: Fixed check on src_length to avoid an unitinialized heap read (bsc#1239222).
    - CVE-2025-2174: Fixed integer overflow leading to heap overflow in src/conv.c, src/io-sim.c, src/search.c     (bsc#1239299).
    - CVE-2025-2175: Fixed integer overflow in _vbi_strndup_iconv (bsc#1239312).
    - CVE-2025-2176: Fixed integer overflow in function vbi_capture_sim_load_caption in src/io-sim.c     (bsc#1239319).
    - CVE-2025-2177: Fixed integer overflow in function vbi_search_new in src/search.c (bsc#1239320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7367-1 advisory.

    It was discovered that zvbi incorrectly handled memory when processing user input. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0979-1 advisory.

    - CVE-2025-2173: Fixed check on src_length to avoid an unitinialized heap read (bsc#1239222).
      - CVE-2025-2174: Fixed integer overflow leading to heap overflow in src/conv.c, src/io-sim.c,     src/search.c (bsc#1239299).
      - CVE-2025-2175: Fixed integer overflow in _vbi_strndup_iconv (bsc#1239312).
      - CVE-2025-2176: Fixed integer overflow in function vbi_capture_sim_load_caption in src/io-sim.c     (bsc#1239319).
      - CVE-2025-2177: Fixed integer overflow in function vbi_search_new in src/search.c (bsc#1239320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
296643	Unity Linux 20.1070e Security Update: zvbi (UTSA-2026-004963)	Nessus	Unity Linux Local Security Checks	medium
296509	Debian dla-4449 : libzvbi-common - security update	Nessus	Debian Local Security Checks	medium
276431	TencentOS Server 4: zvbi (TSSA-2025:0222)	Nessus	Tencent Local Security Checks	medium
259102	Linux Distros Unpatched Vulnerability : CVE-2025-2177	Nessus	Misc.	medium
233314	SUSE SLES12 Security Update : zvbi (SUSE-SU-2025:0988-1)	Nessus	SuSE Local Security Checks	medium
233301	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : zvbi vulnerabilities (USN-7367-1)	Nessus	Ubuntu Local Security Checks	medium
233205	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : zvbi (SUSE-SU-2025:0979-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2025-2177

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium