CVE-2020-35636: Out-of-bounds Read

Published Mar 4, 2021

Updated

A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in NefS2/SNCioparser.h SNCioparser::readsface() sfh->volume() OOB read. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability.

Affected Software

2 affected components

CGAL Computational Geometry Algorithms Library=5.1.1

Debian Debian Linux=10.0

Event History

Mar 4, 2021

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2020-35636?

CVE-2020-35636 has a high severity rating due to its potential for code execution resulting from out-of-bounds reads.

How do I fix CVE-2020-35636?

To mitigate CVE-2020-35636, upgrade to a patched version of CGAL or apply relevant security patches for your operating system.

Which versions of CGAL are affected by CVE-2020-35636?

CVE-2020-35636 affects CGAL version 5.1.1.

What is the impact of CVE-2020-35636?

The impact of CVE-2020-35636 includes potential code execution and type confusion due to a crafted malformed file.

On which operating systems is CVE-2020-35636 present?

CVE-2020-35636 is present on Debian GNU/Linux version 10.0 and potentially other systems using CGAL 5.1.1.