Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2020-35632: CGAL 5.1.1 Nef parser may execute malicious code
CVE-2020-35632 · published 4 years ago
Summary
The CGAL library version 5.1.1, used on Debian, can be tricked by a crafted file into reading data it shouldn't and mixing up data types, which could let an attacker run their own code. This happens in the part of the library that processes Nef polygon files. Apply the latest security update for the cgal package or upgrade to a newer version to protect your systems.
What to do
- Update debian cgal to version 5.2-3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | cgal |
< 5.2-3 Fix: upgrade to 5.2-3
|
| Debian:13 | debian | cgal |
< 5.2-3 Fix: upgrade to 5.2-3
|
| Debian:14 | debian | cgal |
< 5.2-3 Fix: upgrade to 5.2-3
|
| – | cgal | computational_geometry_algorithms_library |
5.1.1 cpe:2.3:a:cgal:computational_geometry_algorithms_library:5.1.1:*:*:*:*:*:*:* |
| – | debian | debian_linux |
10.0 cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
Original advisory text
Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type con...
Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sface() sfh->boundary_entry_objects Edge_of.
References
- https://security-tracker.debian.org/tracker/CVE-2020-35632 Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html Mailing List Third Party Advisory
- https://security.gentoo.org/glsa/202305-34
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225 Exploit Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
8.8
High
Type
CWE-129Improper Validation of Array Index
CWE-125Out-of-bounds Read
Timeline
Published18 Apr 2022
Updated29 Oct 2026
First seen11 Sep 2026
Track software like this
Free during beta