Bugzilla – Bug 1184973
VUL-0: CVE-2020-28601: cgal: code execution vulnerability may lead to oob read
Last modified: 2021-06-02 08:32:15 UTC
CVE-2020-28601 A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser::read_vertex() Face_of[] OOB read. An attacker can provide malicious input to trigger this vulnerability. External Reference: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225 References: https://bugzilla.redhat.com/show_bug.cgi?id=1939901 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-28601 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28601 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E4J344OKKDLPRN422OYRR46HDEN6MM6P/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NB5SF5OJR2DSV7CC6U7FVW5VJSJO5EKV/
Upstream issue: https://github.com/CGAL/cgal/issues/5345 Upstream fix https://github.com/CGAL/cgal/pull/5371 SR#887551 to graphics/cgal waiting for approval
This is an autogenerated message for OBS integration: This bug (1184973) was mentioned in https://build.opensuse.org/request/show/887807 15.2 / cgal https://build.opensuse.org/request/show/887808 Backports:SLE-15-SP3 / cgal
SRs accepted.