Bugzilla – Bug 1184978
VUL-0: CVE-2020-35628: cgal: code execution vulnerability may lead to oob read
Last modified: 2021-06-02 08:33:01 UTC
CVE-2020-35628 A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sloop() slh->incident_sface. An attacker can provide malicious input to trigger this vulnerability. External Reference: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225 References: https://bugzilla.redhat.com/show_bug.cgi?id=1939905 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-35628 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35628 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
Upstream issue: https://github.com/CGAL/cgal/issues/5345 Upstream fix https://github.com/CGAL/cgal/pull/5371 SR#887551 to graphics/cgal waiting for approval
This is an autogenerated message for OBS integration: This bug (1184978) was mentioned in https://build.opensuse.org/request/show/887807 15.2 / cgal https://build.opensuse.org/request/show/887808 Backports:SLE-15-SP3 / cgal
SRs accepted.