CVE-2023-36746

NameCVE-2023-36746
DescriptionMultiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 fstWritex len functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the handling of `len` in `fstWritex` when parsing the time table.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1060407

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gtkwave (PTS)buster3.3.98-1vulnerable
bullseye3.3.104-2vulnerable
bookworm3.3.114-2vulnerable
sid3.3.116-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gtkwavesource(unstable)(unfixed)1060407

Notes

https://talosintelligence.com/vulnerability_reports/TALOS-2023-1793

Search for package or bug name: Reporting problems