Security update for zvbi SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2025:0988-1 Final 1 1 2025-03-24T09:32:22Z current 2025-03-24T09:32:22Z 2025-03-24T09:32:22Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for zvbi This update for zvbi fixes the following issues: - CVE-2025-2173: Fixed check on src_length to avoid an unitinialized heap read (bsc#1239222). - CVE-2025-2174: Fixed integer overflow leading to heap overflow in src/conv.c, src/io-sim.c, src/search.c (bsc#1239299). - CVE-2025-2175: Fixed integer overflow in _vbi_strndup_iconv (bsc#1239312). - CVE-2025-2176: Fixed integer overflow in function vbi_capture_sim_load_caption in src/io-sim.c (bsc#1239319). - CVE-2025-2177: Fixed integer overflow in function vbi_search_new in src/search.c (bsc#1239320). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2025-988,SUSE-SLE-SERVER-12-SP5-LTSS-2025-988,SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2025-988 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2025/suse-su-20250988-1/ Link for SUSE-SU-2025:0988-1 https://lists.suse.com/pipermail/sle-security-updates/2025-March/020581.html E-Mail link for SUSE-SU-2025:0988-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1239222 SUSE Bug 1239222 https://bugzilla.suse.com/1239299 SUSE Bug 1239299 https://bugzilla.suse.com/1239312 SUSE Bug 1239312 https://bugzilla.suse.com/1239319 SUSE Bug 1239319 https://bugzilla.suse.com/1239320 SUSE Bug 1239320 https://www.suse.com/security/cve/CVE-2025-2173/ SUSE CVE CVE-2025-2173 page https://www.suse.com/security/cve/CVE-2025-2174/ SUSE CVE CVE-2025-2174 page https://www.suse.com/security/cve/CVE-2025-2175/ SUSE CVE CVE-2025-2175 page https://www.suse.com/security/cve/CVE-2025-2176/ SUSE CVE CVE-2025-2176 page https://www.suse.com/security/cve/CVE-2025-2177/ SUSE CVE CVE-2025-2177 page SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 libzvbi0-0.2.35-3.3.1 libzvbi0-32bit-0.2.35-3.3.1 libzvbi0-64bit-0.2.35-3.3.1 zvbi-0.2.35-3.3.1 zvbi-devel-0.2.35-3.3.1 zvbi-devel-32bit-0.2.35-3.3.1 zvbi-devel-64bit-0.2.35-3.3.1 libzvbi0-0.2.35-3.3.1 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS zvbi-devel-0.2.35-3.3.1 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS libzvbi0-0.2.35-3.3.1 as a component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 zvbi-devel-0.2.35-3.3.1 as a component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 A vulnerability was found in libzvbi up to 0.2.43. It has been classified as problematic. Affected is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to uninitialized pointer. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as 8def647eea27f7fd7ad33ff79c2d6d3e39948dce. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional. CVE-2025-2173 SUSE Linux Enterprise Server 12 SP5-LTSS:libzvbi0-0.2.35-3.3.1 SUSE Linux Enterprise Server 12 SP5-LTSS:zvbi-devel-0.2.35-3.3.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libzvbi0-0.2.35-3.3.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:zvbi-devel-0.2.35-3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20250988-1/ https://www.suse.com/security/cve/CVE-2025-2173.html CVE-2025-2173 https://bugzilla.suse.com/1239222 SUSE Bug 1239222 A vulnerability was found in libzvbi up to 0.2.43. It has been declared as problematic. Affected by this vulnerability is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to integer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is named ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional. CVE-2025-2174 SUSE Linux Enterprise Server 12 SP5-LTSS:libzvbi0-0.2.35-3.3.1 SUSE Linux Enterprise Server 12 SP5-LTSS:zvbi-devel-0.2.35-3.3.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libzvbi0-0.2.35-3.3.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:zvbi-devel-0.2.35-3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20250988-1/ https://www.suse.com/security/cve/CVE-2025-2174.html CVE-2025-2174 https://bugzilla.suse.com/1239299 SUSE Bug 1239299 A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional. CVE-2025-2175 SUSE Linux Enterprise Server 12 SP5-LTSS:libzvbi0-0.2.35-3.3.1 SUSE Linux Enterprise Server 12 SP5-LTSS:zvbi-devel-0.2.35-3.3.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libzvbi0-0.2.35-3.3.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:zvbi-devel-0.2.35-3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20250988-1/ https://www.suse.com/security/cve/CVE-2025-2175.html CVE-2025-2175 https://bugzilla.suse.com/1239312 SUSE Bug 1239312 A vulnerability classified as critical has been found in libzvbi up to 0.2.43. This affects the function vbi_capture_sim_load_caption of the file src/io-sim.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The identifier of the patch is ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional. CVE-2025-2176 SUSE Linux Enterprise Server 12 SP5-LTSS:libzvbi0-0.2.35-3.3.1 SUSE Linux Enterprise Server 12 SP5-LTSS:zvbi-devel-0.2.35-3.3.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libzvbi0-0.2.35-3.3.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:zvbi-devel-0.2.35-3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20250988-1/ https://www.suse.com/security/cve/CVE-2025-2176.html CVE-2025-2176 https://bugzilla.suse.com/1239319 SUSE Bug 1239319 A vulnerability classified as critical was found in libzvbi up to 0.2.43. This vulnerability affects the function vbi_search_new of the file src/search.c. The manipulation of the argument pat_len leads to integer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional. CVE-2025-2177 SUSE Linux Enterprise Server 12 SP5-LTSS:libzvbi0-0.2.35-3.3.1 SUSE Linux Enterprise Server 12 SP5-LTSS:zvbi-devel-0.2.35-3.3.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libzvbi0-0.2.35-3.3.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:zvbi-devel-0.2.35-3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20250988-1/ https://www.suse.com/security/cve/CVE-2025-2177.html CVE-2025-2177 https://bugzilla.suse.com/1239320 SUSE Bug 1239320