CVE-2023-35961: 
NixOS vulnerability analysis and mitigation

Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities. This vulnerability specifically concerns decompression in vcd_recorder_main (NVD, Talos).

The vulnerability exists in the vcd_recorder_main decompression functionality. When GTKWave opens a file with .gz or .zip extension, it builds a command by concatenating the WAVE_DECOMPRESSOR string to the input file name and passes it to popen, which executes the string as a shell command. As the filename is not sanitized before being used with popen, this leads to a command injection vulnerability via the input file name. The vulnerability has been assigned a CVSS v3.1 score of 7.8 (High) with vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Talos).

If exploited, this vulnerability allows attackers to execute arbitrary commands on the target system with the privileges of the user running GTKWave. The attack requires user interaction as the victim needs to open a maliciously crafted wave file (Talos).

The vulnerability has been fixed in GTKWave version 3.3.118. Users are advised to upgrade to this version or later. The fix is available from the official source (Talos, Debian Security).