by Kastro
Paper/Archive/CVE-2020-28601

CVE-2020-28601

talos — A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1.

EPSS 3%CVSS 10.0
critical.is priorityof 100
47
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 87.0.870 × 2017.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser::read_vertex() Face_of[] OOB read. An attacker can provide malicious input to trigger this vulnerability.

Affected

ProductAffectedFixed inSource
CGALCGAL Project libcgal CGAL-5.1.1–CNA

Scores by source

talos (CNA)10.0CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reftalosintelligence.com/vulnerability_reports/TALOS-2020-1225advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4J344OKKDLPRN422OYRR46HDEN6MM6Padvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NB5SF5OJR2DSV7CC6U7FVW5VJSJO5EKVreflists.debian.org/debian-lts-announce/2021/05/msg00002.htmlreflists.debian.org/debian-lts-announce/2022/12/msg00011.htmladvisorysecurity.gentoo.org/glsa/202305-34