The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-9de542ab4c advisory.

  - A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1.
    An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser::read_vertex() Face_of[] OOB read.
    An attacker can provide malicious input to trigger this vulnerability. (CVE-2020-28601)

  - A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1.
    An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sloop() slh->twin() An     attacker can provide malicious input to trigger this vulnerability. (CVE-2020-28636)

  - A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1.
    An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sloop()     slh->incident_sface. An attacker can provide malicious input to trigger this vulnerability.
    (CVE-2020-35628)

  - A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1.
    An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sface() sfh->volume(). An     attacker can provide malicious input to trigger this vulnerability. (CVE-2020-35636)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Four security issues have been discovered in cgal. A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL.

CVE-2020-28601

An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser::read_vertex() Face_of[] OOB read. An attacker can provide malicious input to trigger this vulnerability.

CVE-2020-28636

An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sloop() slh->twin() An attacker can provide malicious input to trigger this vulnerability.

CVE-2020-35628

An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sloop() slh->incident_sface. An attacker can provide malicious input to trigger this vulnerability.

CVE-2020-35636

An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sface() sfh->volume(). An attacker can provide malicious input to trigger this vulnerability.

For Debian 9 stretch, these problems have been fixed in version 4.9-1+deb9u1.

We recommend that you upgrade your cgal packages.

For the detailed security status of cgal please refer to its security tracker page at: https://security-tracker.debian.org/tracker/cgal

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
148158	Fedora 33 : CGAL (2021-9de542ab4c)	Nessus	Fedora Local Security Checks	3/26/2021	1/8/2024	critical
149261	Debian DLA-2649-1 : cgal security update	Nessus	Debian Local Security Checks	5/5/2021	1/12/2024	critical
168418	Debian DLA-3226-1 : cgal - LTS security update	Nessus	Debian Local Security Checks	12/6/2022	9/20/2023	critical
176472	GLSA-202305-34 : CGAL: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	5/30/2023	5/30/2023	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical