CVE-2020-35633 Memory corruption in CGAL Project
A specially crafted malformed file can trigger an out-of-bounds read and type confusion in CGAL, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-35633?
CVE-2020-35633 is a critical memory corruption vulnerability in Debian Debian Linux, published on 30 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sface() store_sm_boundary_item() Edge_of.A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability.
Weakness: CWE-129
Which versions are affected by CVE-2020-35633?
It affects 2 products.
Products include Cgal Computational Geometry Algorithms Library, Debian Debian Linux.
How do I fix CVE-2020-35633?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-35633 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-35633 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2020-35633, GHSA-7xq8-98gv-5g29, UBUNTU-CVE-2020-35633.