The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4449 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4449-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     January 24, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : zvbi     Version        : 0.2.35-18+deb11u1     CVE ID         : CVE-2025-2173 CVE-2025-2174 CVE-2025-2175 CVE-2025-2176                      CVE-2025-2177


    Several issues have been found in zvbi, a Vertical Blanking Interval     decoder.
    CVE-2025-2173 is related to an uninitialized pointer in src/conv.c::
    vbi_strndup_iconv_ucs2()     The other issues are related to integer overflows in several functions     distributed all over the code.



    For Debian 11 bullseye, these problems have been fixed in version     0.2.35-18+deb11u1.

    We recommend that you upgrade your zvbi packages.

    For the detailed security status of zvbi please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/zvbi

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-4449 : libzvbi-common - security update

medium Nessus Plugin ID 296509

Version 1.2

Version 1.1

Version 1.2 Feb 3, 2026, 2:33 PM CVSS metrics ("CVSSv2 score" set to 7.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C") CVSSv2 score source (changed from "CVE-2025-2177" to "CVE-2025-2176") CVSSv3 score source (changed from "CVE-2025-2176" to none) Plugin Feed: 202602031433
Version 1.1 Jan 25, 2026, 5:54 AM New Plugin Feed: 202601250554