CVE-2023-35957: 
NixOS vulnerability analysis and mitigation

Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A specially-crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities. This vulnerability specifically concerns the decompression function uncompress (NVD, Talos).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 HIGH with vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue exists in the decompression functionality where a heap-based buffer overflow can occur during the parsing of VCDATA blocks. The vulnerability is triggered when processing specially crafted .fst files through the fstReaderIterBlocks2 function (Talos).

If successfully exploited, this vulnerability can lead to arbitrary code execution on the target system. The attacker would need to convince a user to open a malicious .fst file to trigger the vulnerability (NVD, Talos).

The vulnerability has been fixed in GTKWave version 3.3.118. Users are advised to upgrade to this version or later. The fix has been included in various distribution security updates, including Debian's security update DSA-5653-1 (Debian Security).