PT-2024-12743 · Gtkwave · Gtkwave

Claudio Bozzato · Published 2024-01-08 · Updated 2024-04-09 · CVE-2023-38619

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GTKWave version 3.3.115

Description The issue is related to multiple integer overflow vulnerabilities in the VZT facgeometry parsing functionality. A specially crafted .vzt file can lead to arbitrary code execution if a victim opens the malicious file. The vulnerability specifically concerns integer overflow when allocating the msb array.

Recommendations For GTKWave version 3.3.115, consider avoiding the use of .vzt files from untrusted sources until a patch is available. As a temporary workaround, restrict the functionality related to VZT facgeometry parsing to minimize the risk of exploitation.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2023-38619

DLA-3785-1

DSA-5653-1

Affected Products

Gtkwave

References · 11

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2023-1812 · Exploit
• https://osv.dev/vulnerability/CVE-2023-38619 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38619 · Security Note
• https://osv.dev/vulnerability/DSA-5653-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-38619 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-38619 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3785-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-38619 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-38619 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-38619 · Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html · Note