CVE-2025-6966
published 2025-12-05CVE-2025-6966: NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via…
PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.13%
2.7th percentile
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | python-apt | < 0.9.3.5ubuntu3+esm5 | 0.9.3.5ubuntu3+esm5 |
| canonical | python-apt | >= 0 < 2.2.1.1 | 2.2.1.1 |
| canonical | python-apt | >= 0 < 3.1.0 | 3.1.0 |
| canonical | python-apt | >= 1.1 < 1.1.0~beta1ubuntu0.16.04.12+esm1 | 1.1.0~beta1ubuntu0.16.04.12+esm1 |
| canonical | python-apt | >= 1.6 < 1.6.6ubuntu0.1~esm1 | 1.6.6ubuntu0.1~esm1 |
| canonical | python-apt | >= 2.0 < 2.0.1ubuntu0.20.04.1+esm1 | 2.0.1ubuntu0.20.04.1+esm1 |
| canonical | python-apt | >= 2.4 < 2.4.0ubuntu4.1 | 2.4.0ubuntu4.1 |
| canonical | python-apt | >= 2.7 < 2.7.7ubuntu5.1 | 2.7.7ubuntu5.1 |
| canonical | python-apt | >= 3.0 < 3.0.0ubuntu1.1 | 3.0.0ubuntu1.1 |
| canonical | python-apt | >= 3.0 < 3.0.0ubuntu0.25.04.1 | 3.0.0ubuntu0.25.04.1 |
| debian | debian_linux | — | — |
| debian | python-apt | < python-apt 2.2.1.1 (bullseye) | python-apt 2.2.1.1 (bullseye) |
| ubuntu | python-apt | < 0.9.3.11 | 0.9.3.11 |
| ubuntu | python-apt | — | — |
| ubuntu | python-apt | — | — |
| ubuntu | python-apt | — | — |
| ubuntu | python-apt | — | — |
| ubuntu | python-apt | — | — |
| ubuntu | python-apt | — | — |
| ubuntu | python-apt | — | — |
| ubuntu | python-apt | — | — |
| ubuntu | python-apt | >= 1.6.0 < 1.6.6 | 1.6.6 |
| ubuntu | python-apt | >= 2.0.0 < 2.0.1 | 2.0.1 |
| ubuntu | python-apt | >= 2.7.0 < 2.7.7 | 2.7.7 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv4.06.9MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv6.9MEDIUM
vendor_debian6.9MEDIUM
vendor_redhat6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
python-apt regression
vendor_ubuntu·2026-01-15
CVE-2025-6966 python-apt regression
Title: python-apt regression
Summary: USN-7916-1 introduced a regression in python-apt
USN-7916-1 fixed a vulnerability in python-apt. The update had a
PEP 440 incompatible version. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Julian Andres Klode discovered that python-apt incorrectly handled
deb822 configuration files. An attacker could use this issue to cause
python-apt to crash, resulting in a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
python-apt vulnerability
vendor_ubuntu·2025-12-09
CVE-2025-6966 python-apt vulnerability
Title: python-apt vulnerability
Summary: python-apt could be made to crash if it opened a specially crafted
file.
Julian Andres Klode discovered that python-apt incorrectly handled
deb822 configuration files. An attacker could use this issue to cause
python-apt to crash, resulting in a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
python-apt: python-apt: NULL pointer dereference leads to local denial of service
vendor_redhat·2025-12-05·CVSS 6.9
CVE-2025-6966 [MEDIUM] CWE-476 python-apt: python-apt: NULL pointer dereference leads to local denial of service
python-apt: python-apt: NULL pointer dereference leads to local denial of service
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
A flaw was found in python-apt. This vulnerability allows a local attacker to cause a denial of service (Denial of Service) (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
Statement: This vulnerability is rated Low for Red Hat as it requires a local attacker to provide a crafted deb822 file to trigger a NULL pointer dereference in `python-apt`, leading to a denial of service (process crash). Red Hat products that utilize `python-apt` and process untrusted deb822 files ma
Red Hat
kernel: qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
vendor_redhat·2025-05-02·CVSS 5.5
CVE-2023-53066 [MEDIUM] CWE-476 kernel: qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
kernel: qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
In the Linux kernel, the following vulnerability has been resolved:
qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
We have to make sure that the info returned by the helper is valid
before using it.
Found by Linux Verification Center (linuxtesting.org) with the SVACE
static analysis tool.
A flaw was found in the QED SR-IOV support in the Linux kernel. Improper validation of the value returned from the qed_iov_get_vf_info function can cause a NULL pointer dereference and result in a denial of service.
Statement: This issue has been fixed in Red Hat Enterprise Linux 9.6 via RHSA-2025:6966 [1].
[1]. https://access.redhat.com/errata/RHSA-2025:6966
Package: kernel (Red Hat Enterprise Linux 10) - Not
Debian
CVE-2025-6966: python-apt - NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux s...
vendor_debian·2025·CVSS 6.9
CVE-2025-6966 [MEDIUM] CVE-2025-6966: python-apt - NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux s...
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
Scope: local
bookworm: open
bullseye: resolved (fixed in 2.2.1.1)
forky: resolved (fixed in 3.1.0)
sid: resolved (fixed in 3.1.0)
trixie: open
OSV
CVE-2025-6966: NULL pointer dereference in TagSection
osv·2025-12-05·CVSS 6.9
CVE-2025-6966 [MEDIUM] CVE-2025-6966: NULL pointer dereference in TagSection
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
GHSA
GHSA-285f-828q-q7g5: NULL pointer dereference in TagSection
ghsa_unreviewed·2025-12-05
CVE-2025-6966 [MEDIUM] CWE-476 GHSA-285f-828q-q7g5: NULL pointer dereference in TagSection
NULL pointer dereference in TagSection.keys() in python-apt on APT-based
Linux systems allows a local attacker to cause a denial of service
(process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-1272 kernel: Secure Boot does not automatically enable kernel lockdown
bugzilla·2025-02-13·CVSS 7.7
CVE-2025-1272 [HIGH] CVE-2025-1272 kernel: Secure Boot does not automatically enable kernel lockdown
CVE-2025-1272 kernel: Secure Boot does not automatically enable kernel lockdown
The Linux Kernel lockdown mode for kernel versions starting on 6.12 and above for Fedora Linux has the lockdown mode disabled without any warning. This may allow an attacker to gain access to sensitive information such kernel memory mappings, I/O ports, BPF and kprobes. Additionally unsigned modules can be loaded, leading to execution of untrusted code breaking breaking any Secure Boot protection. This vulnerability affects only Fedora Linux.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-36968 kernel: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
bugzilla·2024-06-14·CVSS 6.5
CVE-2024-36968 [MEDIUM] CVE-2024-36968 kernel: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
CVE-2024-36968 kernel: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
The Linux kernel CVE team has assigned CVE-2024-36968 to this issue.
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024060804-CVE-2024-36968-6d78@gregkh/T
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 2293932]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-36880 kernel: Bluetooth: qca: add missing firmware sanity checks
bugzilla·2024-06-02·CVSS 7.8
CVE-2024-36880 [HIGH] CVE-2024-36880 kernel: Bluetooth: qca: add missing firmware sanity checks
CVE-2024-36880 kernel: Bluetooth: qca: add missing firmware sanity checks
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: qca: add missing firmware sanity checks
The Linux kernel CVE team has assigned CVE-2024-36880 to this issue.
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024053031-CVE-2024-36880-c961@gregkh/T
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 2284281]
---
The result of automatic check (that is developed by Alexander Larkin) for this CVE-2024-36880 is: SKIP No affected files built, so skip this CVE NO - - unknown (where first YES/NO value means if related sources built).
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 ht
Bugzilla
CVE-2024-27008 kernel: drm: nv04: Fix out of bounds access
bugzilla·2024-05-01·CVSS 7.8
CVE-2024-27008 [HIGH] CVE-2024-27008 kernel: drm: nv04: Fix out of bounds access
CVE-2024-27008 kernel: drm: nv04: Fix out of bounds access
In the Linux kernel, the following vulnerability has been resolved:
drm: nv04: Fix out of bounds access
The Linux kernel CVE team has assigned CVE-2024-27008 to this issue.
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024050148-CVE-2024-27008-5964@gregkh/T
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 2278284]
---
The result of automatic check (that is developed by Alexander Larkin) for this CVE-2024-27008 is: SKIP No affected files built, so skip this CVE NO - - unknown (where first YES/NO value means if related sources built).
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata
2025-12-05
Published