PT-2024-12742 · Gtkwave · Gtkwave

Claudio Bozzato · Published 2024-01-08 · Updated 2024-04-09 · CVE-2023-38618

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GTKWave version 3.3.115

Description The issue is related to multiple integer overflow vulnerabilities in the VZT facgeometry parsing functionality. These vulnerabilities can be triggered by a specially crafted .vzt file, potentially leading to arbitrary code execution when a victim opens the malicious file. The vulnerability specifically concerns integer overflow when allocating the rows array.

Recommendations For GTKWave version 3.3.115, consider avoiding the use of .vzt files from untrusted sources until a fix is available. As a temporary workaround, restrict the functionality related to VZT facgeometry parsing to minimize the risk of exploitation.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2023-38618

DLA-3785-1

DSA-5653-1

Affected Products

Gtkwave

References · 11

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2023-1812 · Exploit
• https://ubuntu.com/security/CVE-2023-38618 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3785-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-38618 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5653-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38618 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38618 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-38618 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-38618 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-38618 · Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html · Note