CVE-2020-28617: 
Linux Debian vulnerability analysis and mitigation

Multiple code execution vulnerabilities exist in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. The vulnerability specifically affects the vh->sfaceslast() function in NefS2/SNCioparser.h (NVD, Debian Security).

The vulnerability exists in the NefS2/SNCioparser.h file within the SNCioparser::readvertex() function. The issue occurs when reading vertex data, specifically in the vh->sfaces_last() operation where an out-of-bounds read can occur due to improper validation of array indices. The vulnerability is classified under CWE-129 (Improper Validation of Array Index) and CWE-125 (Out-of-bounds Read) (CVMAP Report).

The vulnerability allows an attacker to potentially execute arbitrary code by providing malicious input. The out-of-bounds read and resulting type confusion could lead to memory corruption and code execution in the context of the application processing the malformed Nef polygon data (Talos).

The vulnerability has been fixed in multiple versions across different distributions: Debian 10 (Buster) in version 4.13-1+deb10u1, Debian Bullseye in version 5.2-3, and Gentoo in version 5.4.1 and later. Users are recommended to upgrade to the fixed versions (Debian LTS, Gentoo Security).