CVE-2025-2175

libzvbi _vbi_strndup_iconv integer overflow

View on CVE.org
Published Mar 11, 2025 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4449-1 zvbi security update
EUVD EUVD EUVD-2025-7528 A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.
Ubuntu USN Ubuntu USN USN-7367-1 zvbi vulnerabilities
History
Type Values Removed Values Added
First Time appeared Zapping-vbi
Zapping-vbi zvbi
CPEs cpe:2.3:a:zapping-vbi:zvbi:*:*:*:*:*:*:*:*
Vendors & Products Zapping-vbi
Zapping-vbi zvbi
Type Values Removed Values Added
Metrics epss

{'score': 0.00059}

 epss

{'score': 0.0009}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.
Title libzvbi _vbi_strndup_iconv integer overflow
Weaknesses CWE-189
CWE-190
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:P'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Mar 11, 2025, 5:13 PM
Reserved
Mar 10, 2025, 5:27 PM

View source JSON

Updated
Mar 11, 2025, 5:13 PM

JSON

Status
Analyzed
Published
Mar 11, 2025, 7:15 AM
Modified
Jun 17, 2026, 9:06 AM

View source JSON

No data.

No data.