Bug 2257435 (CVE-2023-32650, CVE-2023-34087, CVE-2023-34436, CVE-2023-35004, CVE-2023-35057, CVE-2023-35128, CVE-2023-35702, CVE-2023-35703, CVE-2023-35704, CVE-2023-35955, CVE-2023-35956, CVE-2023-35957, CVE-2023-35958, CVE-2023-35959, CVE-2023-35960, CVE-2023-35961, CVE-2023-35962, CVE-2023-35963, CVE-2023-35964, CVE-2023-35969, CVE-2023-35970, CVE-2023-35989, CVE-2023-35992, CVE-2023-35994, CVE-2023-35995, CVE-2023-35996, CVE-2023-35997, CVE-2023-36746, CVE-2023-36747, CVE-2023-36861, CVE-2023-36864, CVE-2023-36915, CVE-2023-36916, CVE-2023-37282, CVE-2023-37416, CVE-2023-37417, CVE-2023-37418, CVE-2023-37419, CVE-2023-37420, CVE-2023-37442, CVE-2023-37443, CVE-2023-37444, CVE-2023-37445, CVE-2023-37446, CVE-2023-37447, CVE-2023-37573, CVE-2023-37574, CVE-2023-37575, CVE-2023-37576, CVE-2023-37577, CVE-2023-37578, CVE-2023-37921, CVE-2023-37922, CVE-2023-37923, CVE-2023-38583, CVE-2023-38618, CVE-2023-38619, CVE-2023-38620, CVE-2023-38621, CVE-2023-38622, CVE-2023-38623, CVE-2023-38648, CVE-2023-38649, CVE-2023-38650, CVE-2023-38651, CVE-2023-38652, CVE-2023-38653, CVE-2023-38657, CVE-2023-39234, CVE-2023-39235, CVE-2023-39270, CVE-2023-39271, CVE-2023-39272, CVE-2023-39273, CVE-2023-39274, CVE-2023-39275, CVE-2023-39316, CVE-2023-39317, CVE-2023-39413, CVE-2023-39414, CVE-2023-39443, CVE-2023-39444)

Summary: gtkwave: Multiple CVEs published by Talos
Product: [Other] Security Response Reporter: Zack Miele <zmiele>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: gtkwave-3.3.118 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2024-01-22 14:25:19 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 2257437, 2257438    
Bug Blocks:    

Description Zack Miele 2024-01-09 16:13:02 UTC
Multiple heap-based buffer overflow vulnerabilities exist in GTKWave 3.3.115. Specially-crafted files can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.

Comment 1 Zack Miele 2024-01-09 16:25:30 UTC
All CVEs are resolved in gtkwave-3.3.118

Comment 2 Zack Miele 2024-01-09 16:25:50 UTC
Created gtkwave tracking bugs for this issue:

Affects: epel-all [bug 2257438]
Affects: fedora-all [bug 2257437]

Comment 3 Zack Miele 2024-01-22 14:25:18 UTC
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.