CVE-2023-35955

Summary (CVE-2023-35955) : GTKWave, a waveform viewer, contains multiple heap-based buffer overflow vulnerabilities in the fstReaderIterBlocks2 VCDATA parsing path. The flaws are triggered by parsing a malformed .fst file, potentially allowing arbitrary code execution via the LZ4_decompress_safe_...

CVE-2023-35955

Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A specially-crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerabili...

CVE-2023-35956

Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A specially-crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerabili...

CVE-2023-35958

GTKWave 3.3.115 is affected by multiple heap-based buffer overflows in the fstReaderIterBlocks2 VCDATA parsing path. The vulnerability (CVE-2023-35958) allows arbitrary code execution when a malicious .fst file is opened, related to the copy function fstFread. Patches upgrade GTKWave to 3.3.118 s...

CVE-2023-35963

Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression...

CVE-2023-35970

GTKWave contains multiple heap-based buffer overflow vulnerabilities in the fstReaderIterBlocks2 chain_table parsing of FST_BL_VCDATA_DYN_ALIAS2, enabling arbitrary code execution when a crafted .fst file is opened. Affected product: GTKWave 3.3.115 (and related Debian/OSS advisories list 3.3.98+...

CVE-2023-35970

Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 chaintable parsing functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This...

CVE-2023-35959

Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns .ghw...

CVE-2023-35963

CVE-2023-35963 affects GTKWave (notably the waveform viewer) with multiple OS command injection flaws in the decompression code of the vcd2lxt2 utility when processing crafted wave files. Affected: GTKWave 3.3.115 (Debian/Ubuntu/Debian-LTS advisories cite upgrades to 3.3.118 or similar for bullse...

CVE-2023-35962

Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression...

CVE-2023-35963

Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression...

CVE-2023-35970

Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 chaintable parsing functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This...

CVE-2023-35961

Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression...

CVE-2023-35962

Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression...

CVE-2023-35960

GTKWave 3.3.115 contains multiple OS command injection vulnerabilities in its legacy decompression path (vcd_main). A specially crafted VCD/wave file can lead to arbitrary code execution when opened by a user, local access is required and UI interaction is needed. The issue is documented across m...

CVE-2023-35960

Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns legacy...

CVE-2023-35962

Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression...

CVE-2023-35960

Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns legacy...

CVE-2023-35970

Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 chaintable parsing functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This...

CVE-2023-35959

CVE-2023-35959 affects GTKWave (waveform viewer); multiple OS command injection vulnerabilities exist in the .ghw decompression path. An attacker could achieve arbitrary command execution by the user opening a specially crafted .ghw file; local attacker would need to run GTKWave with the affected...