CVE-2020-28634 Memory corruption in libcgal
A specially crafted malformed file can trigger an out-of-bounds read and type confusion in CGAL, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-28634?
CVE-2020-28634 is a critical memory corruption vulnerability in Debian Debian Linux, published on 18 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sedge() seh->next().
Which versions are affected by CVE-2020-28634?
It affects 2 products.
Products include Cgal Computational Geometry Algorithms Library, Debian Debian Linux.
How do I fix CVE-2020-28634?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-28634 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-28634 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2020-28634, GHSA-257p-5vv9-2jff, UBUNTU-CVE-2020-28634.