Vulnerability · Published Apr 18, 2022 · Assigned by talos
CVE-2020-28610
Critical 10.0
In plain English
A critical-severity security flaw in libcgal from CGAL Project. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SM_io_parser.h SM_io_parser<Decorator_>::read_vertex() set_face().
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | cgal | 5.2-3 | DEBIAN-CVE-2020-28610 |
| Debian:13 | cgal | 5.2-3 | DEBIAN-CVE-2020-28610 |
| Debian:14 | cgal | 5.2-3 | DEBIAN-CVE-2020-28610 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CGAL Project | libcgal | CGAL-5.1.1 |
Weakness: CWE-129 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H