CVE-2020-15475

In nDPI through 3.2, ndpiresetpacketlineinfo in lib/ndpimain.c omits certain reinitialization, leading to a use-after-free...

CVE-2020-15476

In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpisearchoracle in lib/protocols/oracle.c...

CVE-2020-15476

In ndpi (Ntop nDPI) up to version 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle (lib/protocols/oracle.c). This is the concrete root cause and affects the Oracle dissector component of the ndpi library. CVSS details from the public records show an attac...

CVE-2020-15476

In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpisearchoracle in lib/protocols/oracle.c...

PT-2020-14438

Name of the Vulnerable Software and Affected Versions nDPI versions prior to 3.2 Description The packet parsing code in nDPI is susceptible to a heap-based buffer over-read issue, specifically within the ndpi parse packet line info function located in lib/ndpi main.c. Recommendations For versions...

PT-2020-14439 · Ntop · Ndpi

Name of the Vulnerable Software and Affected Versions: nDPI versions 3.2 and earlier Description: The issue is related to a heap-based buffer over-read in the H.323 dissector, specifically in the ndpi search h323 function located in lib/protocols/h323.c. This occurs when a payload packet length i...

PT-2020-14443 · Ntop · Ndpi

Name of the Vulnerable Software and Affected Versions: nDPI versions 3.2 and earlier Description: The issue is related to a heap-based buffer over-read in the Oracle protocol dissector. This occurs in the ndpi search oracle function located in lib/protocols/oracle.c. Recommendations: For nDPI...

ndpi:fuzz_ndpi_reader: Heap-use-after-free in check_content_type_and_change_protocol

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=5161200102146048 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzndpireader Job Type: libfuzzerasanndpi Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash Address: 0x62b0000102df Cra...

OSV-2020-92 Heap-buffer-overflow in ndpi_parse_packet_line_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22169 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpiparsepacketlineinfo ndpisearchmailsmtptcp checkndpitcpflowfunc...

OSV-2020-12 Use-of-uninitialized-value in ndpi_parse_packet_line_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23058 Crash type: Use-of-uninitialized-value Crash state: ndpiparsepacketlineinfo ndpicheckhttptcp ndpisearchhttptcp...

OSV-2020-28 Heap-buffer-overflow in get16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20712 Crash type: Heap-buffer-overflow READ 2 Crash state: get16 searchvaliddns ndpisearchdns...

ndpi:fuzz_process_packet: Use-of-uninitialized-value in ndpi_check_dga_name

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=4846815202770944 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzprocesspacket Job Type: libfuzzermsanndpi Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

ndpi:fuzz_process_packet: Heap-buffer-overflow in ndpi_parse_packet_line_info

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=5731163196096512 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzprocesspacket Job Type: libfuzzerasanndpi Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6100000001fa...

ndpi:fuzz_process_packet: Use-of-uninitialized-value in ndpi_parse_packet_line_info

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=5079402106060800 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzprocesspacket Job Type: libfuzzermsanndpi Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

ndpi:fuzz_ndpi_reader: Heap-use-after-free in ndpi_http_check_content

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=5716128734380032 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzndpireader Job Type: libfuzzerasanndpi Platform Id: linux Crash Type: Heap-use-after-free READ 3 Crash Address: 0x62b000012b9a Cra...

ndpi:fuzz_process_packet: Heap-buffer-overflow in ndpi_search_kerberos

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=4791365602115584 Project: ndpi Fuzzing Engine: afl Fuzz Target: fuzzprocesspacket Job Type: aflasanndpi Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60e00000029d Crash State...

ndpi:fuzz_process_packet: Heap-buffer-overflow in ndpi_check_spotify

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=5644310457614336 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzprocesspacket Job Type: libfuzzerasanndpi Platform Id: linux Crash Type: Heap-buffer-overflow READ 7 Crash Address: 0x60300000011f...

ndpi:fuzz_ndpi_reader: Heap-use-after-free in ndpi_http_check_content

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=5150034495799296 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzndpireader Job Type: libfuzzerasanndpi Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x62b00000fbf3 Cra...

ndpi:fuzz_process_packet: Use-of-uninitialized-value in processCertificateElements

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=5892941104283648 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzprocesspacket Job Type: libfuzzermsanndpi Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

ndpi:fuzz_ndpi_reader: Heap-use-after-free in ndpi_strncasestr

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=5698722582495232 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzndpireader Job Type: libfuzzerasanndpi Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x62b00000f730 Cra...