Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2020-15476: Debian nDPI may read beyond memory when scanning Oracle traffic
CVE-2020-15476 · published 6 years ago
Summary
The nDPI network analysis library used in Debian can accidentally read extra data from Oracle protocol messages, which could cause the program to crash or be manipulated. This affects Debian installations that run nDPI version 3.2 or earlier. Update to a newer nDPI release or apply the available security patch to stop the issue.
What to do
- Update debian ndpi to version 3.4-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | ndpi |
< 3.4-1 Fix: upgrade to 3.4-1
|
| Debian:13 | debian | ndpi |
< 3.4-1 Fix: upgrade to 3.4-1
|
| Debian:14 | debian | ndpi |
< 3.4-1 Fix: upgrade to 3.4-1
|
| – | ntop | ndpi |
<= 3.2 cpe:2.3:a:ntop:ndpi:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
9.0 10.0 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
Original advisory text
In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/protocols/oracle.c.
In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/protocols/oracle.c.
References
- https://security-tracker.debian.org/tracker/CVE-2020-15476 Vendor Advisory
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21780 Exploit Patch Third Party Advisory
- https://github.com/ntop/nDPI/commit/b69177be2fbe01c2442239a61832c44e40136c05 Patch Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/08/msg00052.html Issue Tracking Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/08/msg00016.html Mailing List Third Party Advisory
Severity
7.5
High
Type
CWE-125Out-of-bounds Read
Timeline
Published1 Jul 2020
Updated4 Nov 2026
First seen11 Sep 2026
Track software like this
Free during beta