CVE-2020-28604 - Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1

Back Back to CVE browser

HIGH

Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1

Published Apr 18, 2022

8.8

HIGH

CVSS 3.1

EPSS 2.30%

Description

Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_hedge() e->set_next().

Affected products

Vendor CGAL Project Product Libcgal Default
n/a
- Version
  CGAL-5.1.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

CGAL Project

Libcgal

n/a

Version	Status	Constraints
CGAL-5.1.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-125

Out-of-bounds Read

CWE-129

References (3)

https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html
mailing-listMailing ListThird Party Advisory
https://security.gentoo.org/glsa/202305-34
vendor-advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
ExploitThird Party Advisory

Link	Providers	Tags
https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html		mailing-listMailing ListThird Party Advisory
https://security.gentoo.org/glsa/202305-34		vendor-advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225		ExploitThird Party Advisory