--- title: "CVE-2025-2173\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2025-2173?format=md keywords: index, follow --- # CVE-2025-2173 Publication date 11 March 2025 Last updated 3 July 2025 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) ## Cvss 3 Severity Score **5.3 · Medium** [Score breakdown](https://ubuntu.com/security/CVE-2025-2173?format=md#impact-score) Toggle side navigation ## Description A vulnerability was found in libzvbi up to 0.2.43. It has been classified as problematic. Affected is the function vbi\_strndup\_iconv\_ucs2 of the file src/conv.c. The manipulation of the argument src\_length leads to uninitialized pointer. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as 8def647eea27f7fd7ad33ff79c2d6d3e39948dce. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional. [Read the notes from the security team](https://ubuntu.com/security/CVE-2025-2173?format=md#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | zvbi | 26.04 LTS resolute | Not affected | | 25.10 questing | Not affected | | 25.04 plucky | Not affected | | 24.10 oracular | Fixed 0.2.42-2ubuntu0.24.10.2 | | 24.04 LTS noble | Fixed 0.2.42-2ubuntu0.24.04.1~esm1 Ubuntu Pro | | 22.04 LTS jammy | Fixed 0.2.35-19ubuntu0.1~esm1 Ubuntu Pro | | 20.04 LTS focal | Fixed 0.2.35-17ubuntu0.1~esm1 Ubuntu Pro | | 18.04 LTS bionic | Fixed 0.2.35-13ubuntu0.1~esm1 Ubuntu Pro | | 16.04 LTS xenial | Fixed 0.2.35-10ubuntu0.1~esm1 Ubuntu Pro | | 14.04 LTS trusty | Needs evaluation | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) * [Patch details](https://ubuntu.com/security/CVE-2025-2173?format=md#patch-details) ### Get expanded security coverage with Ubuntu Pro Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use. [Get Ubuntu Pro](https://ubuntu.com/pro) [30-day free trial](https://ubuntu.com/pro/free-trial) ## Notes --- ### [rodrigo-zaiden](https://launchpad.net/~rodrigo-zaiden) same fix commit for CVE-2025-2173, CVE-2025-2174 CVE-2025-2175, CVE-2025-2176, CVE-2025-2177 ### Patch details For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) | Package | Patch details | | --- | --- | | zvbi | * Upstream: [ca16721](https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f) | ## Severity score breakdown CVSS version: CVSS v3.0 **Base score** 5.3 · Medium * Base metrics | Parameter | Value | | --- | --- | | Attack vector | Network | | Attack complexity | Low | | Privileges required | None | | User interaction | None | | Scope | Unchanged | | Confidentiality impact | Low | | Integrity impact | None | | Availability impact | None | * Scores | Parameter | Value | | --- | --- | | Base score | 5.3 · Medium | | Exploitability score | - | | Impact score | - | **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-2173) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-2173) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2025-2173) * [Debian](https://security-tracker.debian.org/tracker/CVE-2025-2173) ### Related Ubuntu Security Notices (USN) + [USN-7367-1](https://usn.ubuntu.com/USN-7367-1) + zvbi vulnerabilities + 24 March 2025 ### Other references * * * * * *