Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2020-28601: CGAL 5.1.1 may execute code from crafted files
CVE-2020-28601 · published 5 years ago
Summary
The CGAL library version 5.1.1 can read specially crafted polygon data and inadvertently run unauthorized code. This happens because the library reads past the end of a data structure when processing certain inputs. Update to a patched version of CGAL or apply the vendor’s recommended fix to stop the issue.
What to do
- Update debian cgal to version 5.2-3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | cgal |
< 5.2-3 Fix: upgrade to 5.2-3
|
| Debian:13 | debian | cgal |
< 5.2-3 Fix: upgrade to 5.2-3
|
| Debian:14 | debian | cgal |
< 5.2-3 Fix: upgrade to 5.2-3
|
| – | cgal | computational_geometry_algorithms_library |
5.1.1 cpe:2.3:a:cgal:computational_geometry_algorithms_library:5.1.1:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
33 34 cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
| – | debian | debian_linux |
9.0 10.0 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
Original advisory text
A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser::read_vertex() Face_...
A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser::read_vertex() Face_of[] OOB read. An attacker can provide malicious input to trigger this vulnerability.
References
- https://security-tracker.debian.org/tracker/CVE-2020-28601 Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2021/05/msg00002.html Mailing List Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html Mailing List Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://security.gentoo.org/glsa/202305-34
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225 Technical Description Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-129Improper Validation of Array Index
CWE-125Out-of-bounds Read
Timeline
Published4 Mar 2021
Updated31 Oct 2026
First seen11 Sep 2026
Track software like this
Free during beta