CVE-2020-28609: 
Linux Debian vulnerability analysis and mitigation

Multiple code execution vulnerabilities exist in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. The vulnerability was discovered in 2020 and affects the polygon parsing code in the CGAL library (Talos Report, NVD).

The vulnerability specifically exists in Nef2/PMioparser.h PMioparser::readface() store_iv() function where an out-of-bounds read vulnerability can be triggered. The issue has been assigned a CVSS v3.1 Base Score of 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) by NIST and 10.0 CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) by Talos. The vulnerability is classified under CWE-129 (Improper Validation of Array Index) and CWE-125 (Out-of-bounds Read) (NVD).

The vulnerability can lead to code execution through out-of-bounds read and type confusion when parsing malformed Nef polygon files. An attacker can trigger this vulnerability by providing malicious input, potentially leading to unauthorized code execution on the affected system (Talos Report).

For Debian 10 (buster), these problems have been fixed in version 4.13-1+deb10u1. Users are recommended to upgrade their cgal packages to the latest version (Debian LTS).