CVE-2023-35964 - Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115

Back Back to CVE browser

HIGH

Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115

Published Jan 8, 2024

7.8

HIGH

CVSS 3.1

EPSS 1.48%

Description

Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression in the `vcd2lxt` utility.

Affected products

Vendor GTKWave Product GTKWave Default
n/a
- Version
  3.3.115
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GTKWave

n/a

Version	Status	Constraints
3.3.115	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (4)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-39948		Advisory
https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1786		ExploitThird Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1786