CVE-2025-2175

March 11, 2025, 7:15 a.m.

4.3
Medium

Description

A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.

Product(s) Impacted

Vendor Product Versions
Libzvbi
  • Libzvbi
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-189
None
None

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a libzvbi libzvbi / / / / / / / /

References

https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44
https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf
https://vuldb.com/?ctiid.299204
https://vuldb.com/?id.299204
https://vuldb.com/?submit.512801

Tags

cna@vuldb.com
2025-03-11
CWE-189
CVE-2025-2175

CVSS Score

4.3 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: LOW

    • CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

    View Vector String

Timeline

Published: March 11, 2025, 7:15 a.m.
Last Modified: March 11, 2025, 7:15 a.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

cna@vuldb.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.