CVE-2020-28616: 
Linux Debian vulnerability analysis and mitigation

Multiple code execution vulnerabilities exist in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion in the SNC_io_parser::read_vertex() vh->sfaces_begin() function, which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability (NVD, Talos).

The vulnerability exists in the Nef_S2/SNC_io_parser.h file within the read_vertex() function. When parsing vertex data, the code reads an index value and uses it without validation to access the SFace_of array through vh->sfaces_begin(). This leads to an out-of-bounds read vulnerability that can be triggered by providing a malformed input file containing specially crafted index values (Talos).

The vulnerability allows an attacker to cause out-of-bounds memory reads and potentially achieve code execution through type confusion by providing maliciously crafted input files. This could lead to arbitrary code execution in the context of the application processing the malformed Nef polygon data (Debian LTS).

The vulnerability can be triggered by providing malicious input files containing specially crafted index values. No authentication is required to exploit this vulnerability, as it occurs during file parsing. The vulnerability has been assigned a CVSS v3.0 score of 10.0, indicating critical severity (Talos).

The vulnerability has been fixed in later versions of CGAL. Users should upgrade to a patched version. For Debian 10 (buster), the fix is available in version 4.13-1+deb10u1. For Gentoo, users should upgrade to version 5.4.1 or later (Debian LTS, Gentoo).