SB2021031744 - Fedora 34 update for CGAL

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2020-28601)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in Nef_2/PM_io_parser.h PM_io_parser::read_vertex() Face_of[]. A remote attacker can use a specially crafted file, trigger out-of-bounds read error and read contents of memory on the system.

2) Out-of-bounds read (CVE-ID: CVE-2020-28636)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sloop() slh->twin(). A remote attacker can use a specially crafted file, trigger out-of-bounds read error and read contents of memory on the system.

3) Out-of-bounds read (CVE-ID: CVE-2020-35628)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sloop() slh->incident_sface(). A remote attacker can use a specially crafted file, trigger out-of-bounds read error and read contents of memory on the system.

4) Out-of-bounds read (CVE-ID: CVE-2020-35636)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sface() sfh->volume(). A remote attacker can use a specially crafted file, trigger out-of-bounds read error and read contents of memory on the system.

Remediation

Install update from vendor's website.

References

• https://bodhi.fedoraproject.org/updates/FEDORA-2021-0d42c7cb33