CVE-2020-28606: 
Linux Debian vulnerability analysis and mitigation

Multiple code execution vulnerabilities exist in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. The vulnerability, identified as CVE-2020-28606, was disclosed and involves an out-of-bounds read vulnerability in Nef_2/PM_io_parser.h PM_io_parser::read_hedge() e->set_face(). A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could result in code execution (Talos).

The vulnerability is characterized by an out-of-bounds read in the Nef_2/PM_io_parser.h file, specifically in the PM_io_parser::read_hedge() e->set_face() function. The CVSS v3.1 base score is 8.8 HIGH according to NVD, while Talos rates it at 10.0 CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). The vulnerability is classified under CWE-129 (Improper Validation of Array Index) and CWE-125 (Out-of-bounds Read) (NVD).

The vulnerability can lead to code execution if successfully exploited. When parsing files containing Nef polygon data, the out-of-bounds read and type confusion vulnerabilities could allow an attacker to execute arbitrary code through specially crafted malformed files (Debian LTS).

The vulnerability can be triggered by providing malicious input to the affected component. The attack vector is network-accessible with low attack complexity and requires no privileges or user interaction according to the CVSS metrics (Talos).

For Debian 10 (buster), the vulnerability has been fixed in version 4.13-1+deb10u1. Gentoo users should upgrade to version 5.4.1 or later. The recommended action is to upgrade the CGAL packages to their latest patched versions (Debian LTS, Gentoo).