CVE-2025-6395

MediumCVSS 6.5/10Last modified Nov 5, 2026

Description

A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite().

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-476

Affected software

VendorProductVersions
——< 3.8.10
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support—
Red HatRed Hat Ceph Storage 7—
Red HatRed Hat Discovery 2—
Red HatRed Hat Insights proxy 1.5—
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.5, < *
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < *

References

Timeline

Published
Jul 10, 2025
Last modified
Nov 5, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-639507.5An insecure deserialization vulnerability exists in the download.php script of the to3k Twittodon application through commit b1c58a7d1dc664bCVE-2025-639517.5An insecure deserialization vulnerability exists in the rss-mp3.php script of the MiczFlor RPi-Jukebox-RFID project through commit 4b2334f0aCVE-2025-639525.7A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarilyCVE-2025-639536.5A Cross-Site Request Forgery (CSRF) in the /usapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarilyCVE-2025-639557.5A Cross-Site Request Forgery (CSRF) vulnerability in the manage-students.php component of PHPGurukul Student Record System v3.2 allows an atCVE-2025-639589.8MILLENSYS Vision Tools Workspace 6.5.0.2585 exposes a sensitive configuration endpoint (/MILLENSYS/settings) that is accessible without authCVE-2025-63966.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Webbeyaz Website Design WebsiteCVE-2025-63978.6Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ankara Hosting Website Design WCVE-2025-63986.7A null pointer dereference vulnerability exists in the IOMap64.sys driver of ASUS AI Suite 3. The vulnerability can be triggered by a speciaCVE-2025-63998.8A vulnerability, which was classified as critical, was found in TOTOLINK X15 1.0.0-B20230714.1105. Affected is an unknown function of the fiCVE-2025-64008.8A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101 and classified as critical. Affected by this issue is some unknown functionCVE-2025-64013.5A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101. It has been classified as problematic. This affects an unknown part of the