[CLSA-2026:1790586919] Fix CVE(s): CVE-2025-2173, CVE-2025-2174, CVE-2025-2176

Type:

security

Severity:

Important

Release date:

2026-09-28 09:15:31 UTC

Description:

   * SECURITY UPDATE: uninitialized heap read in vbi_strndup_iconv_ucs2()
     - debian/patches/CVE-2025-2173.patch: return NULL when src_length is
       zero in src/conv.c
     - CVE-2025-2173
   * SECURITY UPDATE: integer overflow leading to heap overflow in
     vbi_strndup_iconv_ucs2()
     - debian/patches/CVE-2025-2174.patch: reject overflowing buffer sizes
       in strndup_identity() and strndup_utf8_ucs2() in src/conv.c
     - CVE-2025-2174
   * SECURITY UPDATE: integer overflow leading to heap overflow in
     vbi_capture_sim_load_caption()
     - debian/patches/CVE-2025-2176.patch: reject overflowing caption buffer
       growth in src/io-sim.c
     - CVE-2025-2176

CVEs fixed:

Updated packages:

libzvbi-common_0.2.35-13+tuxcare.els1_all.deb
sha:5615662deda835a2d82ba6c601b1ed3d7101ee9d
libzvbi-dev_0.2.35-13+tuxcare.els1_amd64.deb
sha:f88c525442cca60105c958a13c119612c6151a05
libzvbi-doc_0.2.35-13+tuxcare.els1_all.deb
sha:8eb5532309206d2b2337d67a5f64066b5113a35c
libzvbi0_0.2.35-13+tuxcare.els1_amd64.deb
sha:30e1c869fd4ab058c83efed9c092d62069fa631d
zvbi_0.2.35-13+tuxcare.els1_amd64.deb
sha:cd7d81d2a61b77a49209720679a886ff4b707cdc

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.