CVE-2020-28616: 
Linux Debian vulnerability analysis and mitigation

Multiple code execution vulnerabilities exist in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion in the SNCioparser::readvertex() vh->sfacesbegin() function, which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability (NVD, Talos).

The vulnerability exists in the NefS2/SNCioparser.h file within the readvertex() function. When parsing vertex data, the code reads an index value and uses it without validation to access the SFaceof array through vh->sfacesbegin(). This leads to an out-of-bounds read vulnerability that can be triggered by providing a malformed input file containing specially crafted index values (Talos).

The vulnerability allows an attacker to cause out-of-bounds memory reads and potentially achieve code execution through type confusion by providing maliciously crafted input files. This could lead to arbitrary code execution in the context of the application processing the malformed Nef polygon data (Debian LTS).

The vulnerability has been fixed in later versions of CGAL. Users should upgrade to a patched version. For Debian 10 (buster), the fix is available in version 4.13-1+deb10u1. For Gentoo, users should upgrade to version 5.4.1 or later (Debian LTS, Gentoo).