CVE-2020-35629

Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sloop() slh->facet().
Configurations

Configuration 1 (hide)

cpe:2.3:a:cgal:computational_geometry_algorithms_library:5.1.1:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

History

30 May 2023, 06:15

Type Values Removed Values Added
References
  • (GENTOO) https://security.gentoo.org/glsa/202305-34 -

09 Jan 2023, 17:54

Type Values Removed Values Added
References (MLIST) https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html - (MLIST) https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html - Mailing List, Third Party Advisory
References (MISC) https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225 - Exploit, Technical Description, Third Party Advisory (MISC) https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225 - Exploit, Third Party Advisory
CPE cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
First Time Debian
Debian debian Linux

06 Dec 2022, 15:15

Type Values Removed Values Added
References
  • (MLIST) https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html -
CWE CWE-125

23 Apr 2022, 02:58

Type Values Removed Values Added
CPE cpe:2.3:a:cgal:computational_geometry_algorithms_library:5.1.1:*:*:*:*:*:*:*
First Time Cgal computational Geometry Algorithms Library
Cgal
References (MISC) https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225 - (MISC) https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225 - Exploit, Technical Description, Third Party Advisory
CVSS v2 : unknown
v3 : unknown
v2 : 6.8
v3 : 8.8
CWE CWE-125
CWE-129

18 Apr 2022, 17:45

Type Values Removed Values Added
New CVE

Information

Published : 2022-04-18 17:15

Updated : 2023-12-10 14:22


NVD link : CVE-2020-35629

Mitre link : CVE-2020-35629

CVE.ORG link : CVE-2020-35629


JSON object : View

Products Affected

debian

  • debian_linux

cgal

  • computational_geometry_algorithms_library
CWE
CWE-129

Improper Validation of Array Index

CWE-125

Out-of-bounds Read