CVE-2020-35635 Memory corruption in CGAL Project
A maliciously crafted file can trigger an out-of-bounds read and type confusion in CGAL, potentially allowing arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-35635?
CVE-2020-35635 is a critical memory corruption vulnerability in Debian Debian Linux, published on 30 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sface() store_sm_boundary_item() Sloop_of OOB read. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability.
Weakness: CWE-129
Which versions are affected by CVE-2020-35635?
It affects 2 products.
Products include Cgal Computational Geometry Algorithms Library, Debian Debian Linux.
How do I fix CVE-2020-35635?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-35635 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-35635 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2020-35635, GHSA-fq65-q9vw-3g2w, UBUNTU-CVE-2020-35635.