CVE-2020-28601: 
Linux Debian vulnerability analysis and mitigation

A code execution vulnerability (CVE-2020-28601) was discovered in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. The vulnerability specifically exists in Nef_2/PM_io_parser.h PM_io_parser::read_vertex() Face_of[] as an out-of-bounds read vulnerability. This issue was disclosed in March 2021 and affects the Computational Geometry Algorithms Library (CGAL) (NVD, Talos).

The vulnerability is an out-of-bounds read issue in the PM_io_parser::read_vertex() function, specifically affecting the Face_of[] array access. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high severity with network attack vector, low attack complexity, and no required privileges or user interaction. The issue has been classified under CWE-125 (Out-of-bounds Read) and CWE-129 (Improper Validation of Array Index) (NVD).

The vulnerability could allow an attacker to trigger code execution by providing malicious input. The out-of-bounds read vulnerability could lead to information disclosure, system crashes, or potential arbitrary code execution depending on the context of exploitation (Talos).

An attacker can trigger this vulnerability by providing malicious input to the affected component. The vulnerability requires no special privileges or user interaction, making it relatively straightforward to exploit given network access to the target system (NVD).

Multiple distributions have released patches to address this vulnerability. Debian released security updates DLA-2649-1 for Debian 9 and DLA-3226-1 for Debian 10. Fedora released version 5.2.1-1.fc34 for Fedora 34 and version 5.1.3-1.fc33 for Fedora 33. Gentoo users are advised to upgrade to version 5.4.1 or later (Debian LTS, Fedora, Gentoo).