CVE-2023-34436

2024-01-0800:00:00

ubuntu.com

vulnerability

gtkwave

arbitrary code execution

lxt2

out-of-bounds write

unix

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

23.1%

JSON

An out-of-bounds write vulnerability exists in the LXT2
num_time_table_entries functionality of GTKWave 3.3.115. A specially
crafted .lxt2 file can lead to arbitrary code execution. A victim would
need to open a malicious file to trigger this vulnerability.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchgtkwave< anyUNKNOWN
ubuntu20.04noarchgtkwave< anyUNKNOWN
ubuntu22.04noarchgtkwave< anyUNKNOWN
ubuntu24.04noarchgtkwave< anyUNKNOWN
ubuntu16.04noarchgtkwave< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	gtkwave	< any	UNKNOWN
ubuntu	20.04	noarch	gtkwave	< any	UNKNOWN
ubuntu	22.04	noarch	gtkwave	< any	UNKNOWN
ubuntu	24.04	noarch	gtkwave	< any	UNKNOWN
ubuntu	16.04	noarch	gtkwave	< any	UNKNOWN