CVE-2025-6395: Gnutls: null pointer dereference in _gnutls_figure_common_ciphersuite()
A NULL pointer dereference flaw was found in the GnuTLS software in gnutlsfigurecommonciphersuite().
Other sources
GNUTLS - NULL pointer dereference in gnutlsfigurecommonciphersuite()
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gnutls28to a version that resolves this vulnerability.Fixed in 3.7.9-2+deb12u7Fixed in 3.8.9-3+deb13u4Fixed in 3.8.13-1 - Upgrade
Upgrade
debian/gnutls28to a version that resolves this vulnerability.Fixed in 3.7.9-2+deb12u5 - Upgrade
Upgrade
debian/gnutls28to a version that resolves this vulnerability.Fixed in 3.8.9-3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6395?
CVE-2025-6395 is considered a high severity vulnerability due to the potential for memory corruption and denial of service.
How do I fix CVE-2025-6395?
To fix CVE-2025-6395, update GnuTLS to the latest version where the vulnerability has been patched.
What impact does CVE-2025-6395 have on GnuTLS users?
CVE-2025-6395 can lead to application crashes and security vulnerabilities, affecting the overall stability of systems using GnuTLS.
Is CVE-2025-6395 exploitable remotely?
Yes, CVE-2025-6395 can be exploited remotely if an attacker can manipulate the template file settings processed by GnuTLS.
What versions of GnuTLS are affected by CVE-2025-6395?
CVE-2025-6395 affects all versions of GnuTLS prior to the patch that addresses this specific vulnerability.