CVE-2020-28612: 
Linux Debian vulnerability analysis and mitigation

Multiple code execution vulnerabilities exist in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. The vulnerability was discovered in 2020 and assigned identifier CVE-2020-28612. The vulnerability specifically affects the SNCioparser::readvertex() vh->sverticesbegin() function in the NefS2/SNCioparser.h file ([Talos Report](https://talosintelligence.com/vulnerabilityreports/TALOS-2020-1225)).

The vulnerability is an out-of-bounds read issue in the NefS2/SNCioparser.h SNCioparser::readvertex() vh->svertices_begin() function. The CVSS v3.1 base score is 8.8 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-125 (Out-of-bounds Read) and CWE-129 (Improper Validation of Array Index) (NVD).

A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could result in code execution. The vulnerability affects the integrity, confidentiality, and availability of the system (Talos Report).

The vulnerability has been addressed in newer versions of the software. Users of affected versions should upgrade to a patched version. For Debian 10 buster, the fix is available in version 4.13-1+deb10u1. For Gentoo users, upgrading to version 5.4.1 or later is recommended (Debian LTS, Gentoo Security).