CVE-2023-35128: 
NixOS vulnerability analysis and mitigation

An integer overflow vulnerability (CVE-2023-35128) exists in the fstReaderIterBlocks2 time_table tsec_nitems functionality of GTKWave 3.3.115. The vulnerability requires a victim to open a specially crafted .fst file that can lead to memory corruption (Talos Intel, NVD).

The vulnerability exists in the fstReaderIterBlocks2 function where the time_table tsec_nitems parameter is processed. When parsing VCDATA blocks, the code allocates memory based on tsec_nitems without proper bounds checking, leading to an integer overflow condition. The vulnerability has a CVSS v3.1 base score of 7.8 HIGH (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) according to NVD, while Talos assessed it with a score of 7.0 HIGH (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) (NVD, Talos Intel).

If successfully exploited, this vulnerability could lead to memory corruption, potentially allowing an attacker to execute arbitrary code on the targeted system. The vulnerability requires user interaction as the victim needs to open a malicious .fst file (Talos Intel).

The vulnerability has been fixed in GTKWave version 3.3.118. Users are advised to upgrade to this version or later (Debian LTS).