CVE-2020-35636 Memory corruption in CGAL Project
A maliciously crafted file can trigger an out-of-bounds read and type confusion in CGAL, potentially allowing arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-35636?
CVE-2020-35636 is a critical memory corruption vulnerability in Debian Debian Linux, published on 4 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sface() sfh->volume() OOB read. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability.
Which versions are affected by CVE-2020-35636?
It affects 2 products.
Products include Cgal Computational Geometry Algorithms Library, Debian Debian Linux.
How do I fix CVE-2020-35636?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-35636 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-35636 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2020-35636, GHSA-7jvh-xr76-gqq7, UBUNTU-CVE-2020-35636.