In nDPI through 3.2, ndpi_reset_packet_line_info in lib/ndpi_main.c omits certain reinitialization, leading to a use-after-free.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15475
Reference (s):
- https://github.com/ntop/nDPI/commit/6a9f5e4f7c3fd5ddab3e6727b071904d76773952