CVE-2023-35958: 
NixOS vulnerability analysis and mitigation

Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A specially-crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities. This vulnerability specifically concerns the copy function fstFread (Talos Report).

The vulnerability exists in the VCDATA parsing functionality, specifically within the fstReaderIterBlocks2 function. The issue occurs during the processing of .fst files, where a heap-based buffer overflow can be triggered through the fstFread function. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

If successfully exploited, this vulnerability can lead to arbitrary code execution on the target system. The impact is considered high as it affects all three security aspects - confidentiality, integrity, and availability - with potential complete compromise of the system (Talos Report).

The vulnerability has been fixed in GTKWave version 3.3.118. Users are advised to upgrade to this version or later to mitigate the risk (Debian LTS).