CVE-2020-28620: Out-of-bounds Read

Published Apr 18, 2022

Updated

Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in NefS2/SNCioparser.h SNCioparser<EW>::readedge() eh->centervertex():.

Affected Software

2 affected components

CGAL Computational Geometry Algorithms Library=5.1.1

Debian Debian Linux=10.0

Event History

Apr 18, 2022

CVE Published

via MITRE·04:56 PM

Data Sourced

via MITRE·04:56 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2020-28620?

CVE-2020-28620 is classified as a high severity vulnerability due to its potential for code execution.

How do I fix CVE-2020-28620?

To resolve CVE-2020-28620, update CGAL to version 5.1.2 or later.

What types of attacks does CVE-2020-28620 enable?

CVE-2020-28620 can enable attacks such as out-of-bounds read and type confusion that may lead to arbitrary code execution.

Which versions of CGAL are affected by CVE-2020-28620?

CVE-2020-28620 affects CGAL version 5.1.1.

Is CVE-2020-28620 present in Debian Linux?

Yes, CVE-2020-28620 is present in Debian GNU/Linux version 10.0.