Vulnerability · Published Apr 18, 2022 · Assigned by talos
CVE-2020-28603
Critical 10.0
In plain English
A critical-severity security flaw in libcgal from CGAL Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_hedge() e->set_prev().
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | cgal | 5.2-3 | DEBIAN-CVE-2020-28603 |
| Debian:13 | cgal | 5.2-3 | DEBIAN-CVE-2020-28603 |
| Debian:14 | cgal | 5.2-3 | DEBIAN-CVE-2020-28603 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CGAL Project | libcgal | CGAL-5.1.1 |
Weakness: CWE-129 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H