CVE-2023-39317

CVE-2023-39317 concerns GTKWave, a waveform viewer. The issue stems from multiple integer overflow vulnerabilities in the LXT2 num_dict_entries allocation (string_lens array) in GTKWave 3.3.115, which could allow arbitrary code execution when a user opens a malformed .lxt2 file. Public disclosure...

CVE-2023-35989

GTKWave 3.3.115 contains an integer overflow in the LXT2 zlib block allocation that can be triggered by opening a malicious .lxt2 file, potentially allowing arbitrary code execution. Public advisories and CVE references (CVE-2023-35989) indicate fixes in newer upstream releases (e.g., 3.3.118 and...

CVE-2023-35057

An integer overflow vulnerability exists in the LXT2 lxt2rdtrace value elements allocation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability...

CVE-2023-35989

An integer overflow vulnerability exists in the LXT2 zlib block allocation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability...

CVE-2023-35057

An integer overflow vulnerability exists in the LXT2 lxt2rdtrace value elements allocation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability...

CVE-2023-35057

An integer overflow vulnerability exists in the LXT2 lxt2rdtrace value elements allocation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability...

CVE-2023-35989

An integer overflow vulnerability exists in the LXT2 zlib block allocation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability...

CVE-2023-35057

GTKWave (GTKWAVE) CVE-2023-35057 affects the LXT2 trace allocation path, where an integer overflow in lxt2_rd_trace value elements allocation can lead to memory corruption when opening a crafted .lxt2 file. Affected version in public report is GTKWave 3.3.115; fixes are implemented in upstream/pa...

CVE-2023-38657

An out-of-bounds write vulnerability exists in the LXT2 zlib block decompression functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability...

CVE-2023-39414

Multiple integer underflow vulnerabilities exist in the LXT2 lxt2rditerradix shift operation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns th...

CVE-2023-39414

Multiple integer underflow vulnerabilities exist in the LXT2 lxt2rditerradix shift operation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns th...

CVE-2023-39414

Multiple integer underflow vulnerabilities exist in the LXT2 lxt2rditerradix shift operation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns th...

CVE-2023-39414

CVE-2023-39414 concerns multiple integer underflow vulnerabilities in GTKWave’s LXT2 lxt2_rd_iter_radix right-shift operation, potentially leading to memory corruption when a malformed .lxt2 file is opened. Public advisories describe GTKWave 3.3.115 as affected; Debian LTS and Debian DSAs list fi...

CVE-2023-38657

GTKWave suffers an out-of-bounds write in the LXT2 zlib block decompression, allowing arbitrary code execution when opening a crafted .lxt2 file (CVE-2023-38657). Public advisories show GTKWAVE upgrades addressing this, e.g. Debian DLA-3785/DSA-5653 and Fedora updates, moving to GTKWave 3.3.118 (...

CVE-2023-38657

An out-of-bounds write vulnerability exists in the LXT2 zlib block decompression functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability...

CVE-2023-38657

An out-of-bounds write vulnerability exists in the LXT2 zlib block decompression functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability...

CVE-2023-39413

Multiple integer underflow vulnerabilities exist in the LXT2 lxt2rditerradix shift operation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns th...

CVE-2023-39443

CVE-2023-39443 affects GTKWave, with multiple out-of-bounds write vulnerabilities in the LXT2 parsing path of GTKWave 3.3.115. A crafted .lxt2 file can trigger arbitrary code execution when opened by a user, due to a flaw in the prefix copy loop. Remediation context from connected documents shows...

CVE-2023-39413

The CVE-2023-39413 issue affects GTKWave’s LXT2 handling (lxt2_rd_iter_radix shift) and can cause memory corruption when opening a crafted .lxt2 file. Public docs confirm GTKWave 3.3.115 (and related builds) are affected, with a fix applied in newer GTKWave releases across distributions: Debian/D...

CVE-2023-39443

Multiple out-of-bounds write vulnerabilities exist in the LXT2 parsing functionality of GTKWave 3.3.115. A specially-crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds...