CVE-2023-38621

NameCVE-2023-38621
DescriptionMultiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `flags` array.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1060407

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gtkwave (PTS)buster3.3.98-1vulnerable
bullseye3.3.104-2vulnerable
bookworm3.3.114-2vulnerable
sid3.3.116-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gtkwavesource(unstable)(unfixed)1060407

Notes

https://talosintelligence.com/vulnerability_reports/TALOS-2023-1812

Search for package or bug name: Reporting problems