Use-After-Free Vulnerability in nDPI Library by ntop
CVE-2020-15475

9.8CRITICAL

Key Information:

Vendor

Ntop

Status
Ndpi
Vendor
CVE Published:
1 July 2020

What is CVE-2020-15475?

The nDPI library, maintained by ntop, is susceptible to a use-after-free vulnerability due to improper reinitialization in the ndpi_reset_packet_line_info function. This flaw arises in versions up to 3.2, potentially causing unpredictable behavior when handling network packets, which could be exploited by attackers to disrupt the application or leverage system memory. Detailed analysis of the issue is available in the related GitHub commit.

References

https://github.com/ntop/nDPI/commit/6a9f5e4f7c3fd5ddab3e6...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.