CVE-2020-28625: 
Linux Debian vulnerability analysis and mitigation

Multiple code execution vulnerabilities exist in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion in the SNC_io_parser::read_facet() function, specifically in the fh->boundary_entry_objects SLoop_of component. An attacker can provide malicious input to trigger this vulnerability (Talos).

The vulnerability exists in the Nef_S2/SNC_io_parser.h file within the SNC_io_parser::read_facet() function. The issue occurs when parsing Nef polygon data, where an out-of-bounds read vulnerability exists in the boundary_entry_objects SLoop_of component. The vulnerability has a CVSS v3.0 score of 10.0 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and is classified under CWE-129 (Improper Validation of Array Index) (Talos).

The vulnerability could lead to code execution through out-of-bounds read and type confusion when processing specially crafted malformed files. This could potentially allow an attacker to execute arbitrary code on the affected system (Talos).

The vulnerability can be triggered by providing malicious input to the application. No special privileges or user interaction is required, making it highly exploitable. The attack vector is network-accessible and requires low complexity to execute (Talos).

The vulnerability has been addressed in subsequent versions of CGAL. Users are recommended to upgrade to a version newer than CGAL-5.1.1. For Debian 10 (buster), the fix is available in version 4.13-1+deb10u1 (Debian LTS). For Gentoo users, upgrading to version 5.4.1 or later is recommended (Gentoo Security).