CVE-2023-35128

NameCVE-2023-35128
DescriptionAn integer overflow vulnerability exists in the fstReaderIterBlocks2 time_table tsec_nitems functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1060407

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gtkwave (PTS)buster3.3.98-1vulnerable
bullseye3.3.104-2vulnerable
bookworm3.3.114-2vulnerable
sid3.3.116-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gtkwavesource(unstable)(unfixed)1060407

Notes

https://talosintelligence.com/vulnerability_reports/TALOS-2023-1792

Search for package or bug name: Reporting problems