CVE-2023-35962

Name	CVE-2023-35962
Description	Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression in the `vcd2vzt` utility.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3785-1, DSA-5653-1
Debian Bugs	1060407

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gtkwave (PTS)	bullseye (security), bullseye	3.3.104+really3.3.118-0+deb11u1	fixed
	bookworm, bookworm (security)	3.3.118-0.1~deb12u1	fixed
	sid, trixie	3.3.120-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
gtkwave	source	buster	3.3.98+really3.3.118-0+deb10u1	DLA-3785-1
gtkwave	source	bullseye	3.3.104+really3.3.118-0+deb11u1	DSA-5653-1
gtkwave	source	bookworm	3.3.118-0.1~deb12u1	DSA-5653-1
gtkwave	source	(unstable)	3.3.118-0.1		1060407

https://talosintelligence.com/vulnerability_reports/TALOS-2023-1786