CVE catalog

CVE-2020-28599

openscad: CVE-2020-28599

Severity: Medium
Published: Feb 24, 2021, 4:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.97% · Oct 25, 2026

A stack-based buffer overflow vulnerability exists in the import_stl.cc:import_stl() functionality of Openscad openscad-2020.12-RC2. A specially crafted STL file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	openscad	sid	`2021.01-14`	fixed
Debian	openscad	trixie	`2021.01-8`	fixed
Debian	openscad	bookworm	`2021.01-6`	fixed
Ubuntu	openscad	16.04	`2015.03-1+dfsg-2ubuntu1`	vulnerable
Ubuntu	openscad	16.04	`2015.03-1+dfsg-2ubuntu2`	vulnerable
Ubuntu	openscad	16.04	`2015.03-1+dfsg-3`	vulnerable
Ubuntu	openscad	20.04	`2019.01~RC2-2build1`	vulnerable
Ubuntu	openscad	20.04	`2019.05-2ubuntu2`	vulnerable
Ubuntu	openscad	20.04	`2019.05-3ubuntu3`	vulnerable
Ubuntu	openscad	20.04	`2019.05-3ubuntu4`	vulnerable
Ubuntu	openscad	20.04	`2019.05-3ubuntu5`	vulnerable
Ubuntu	openscad	22.04	`2021.01-1ubuntu1`	vulnerable
Ubuntu	openscad	22.04	`2021.01-2ubuntu1`	vulnerable
Ubuntu	openscad	22.04	`2021.01-3`	vulnerable
Ubuntu	openscad	22.04	`2021.01-4`	vulnerable
Ubuntu	openscad	22.04	`2021.01-4build1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	openscad	source	sid	`2021.01-1`	not yet assigned	Not reported	[996020]
Debian	openscad	source	trixie	`2021.01-1`	not yet assigned	Not reported	[996020]
Debian	openscad	source	bookworm	`2021.01-1`	not yet assigned	Not reported	[996020]

[Debian bug #996020]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[openscad]Unknown
Details (2)
- 2021.01-6 · amd64 · bookworm
  Fixed · Fixed: 2021.01-1
  dsa · openscad · debian · bookworm; dsa · openscad · debian · 12
- 2021.01-6 · arm64 · bookworm
  Fixed · Fixed: 2021.01-1
  dsa · openscad · debian · bookworm; dsa · openscad · debian · 12
[openscad-testing]Unknown
Source package: [openscad]
Details (2)
- 2021.01-6 · amd64 · bookworm
  Fixed · Fixed: 2021.01-1
  dsa · openscad · debian · bookworm; dsa · openscad · debian · 12
- 2021.01-6 · arm64 · bookworm
  Fixed · Fixed: 2021.01-1
  dsa · openscad · debian · bookworm; dsa · openscad · debian · 12
[openscad-testing-data]Unknown
Source package: [openscad]
Details (2)
- 2021.01-6 · all · bookworm
  Fixed · Fixed: 2021.01-1
  dsa · openscad · debian · bookworm; dsa · openscad · debian · 12
- 2021.01-6 · all · bookworm
  Fixed · Fixed: 2021.01-1
  dsa · openscad · debian · bookworm; dsa · openscad · debian · 12

[Debian 13 (Trixie)]

[openscad]Unknown
Source package: [openscad]
Details (2)
- 2021.01-8 · amd64 · trixie
  Fixed · Fixed: 2021.01-1
  dsa · openscad · debian · 13
- 2021.01-8+b2 · arm64 · trixie
  Fixed · Fixed: 2021.01-1
  dsa · openscad · debian · 13
[openscad-testing]Unknown
Source package: [openscad]
Details (2)
- 2021.01-8 · amd64 · trixie
  Fixed · Fixed: 2021.01-1
  dsa · openscad · debian · 13
- 2021.01-8+b2 · arm64 · trixie
  Fixed · Fixed: 2021.01-1
  dsa · openscad · debian · 13
[openscad-testing-data]Unknown
Source package: [openscad]
Details (2)
- 2021.01-8 · all · trixie
  Fixed · Fixed: 2021.01-1
  dsa · openscad · debian · 13
- 2021.01-8 · all · trixie
  Fixed · Fixed: 2021.01-1
  dsa · openscad · debian · 13

Observed: Oct 23, 2026, 5:51:09 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]