CVE-2023-36747: 
NixOS vulnerability analysis and mitigation

Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 fstWritex len functionality of GTKWave 3.3.115. The vulnerability was discovered in the handling of len in fstWritex when beg_time does not match the start of the time table. A specially crafted .fst file can lead to memory corruption, requiring a victim to open a malicious file to trigger these vulnerabilities (Talos).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) by NIST and 7.0 HIGH (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) by Talos. The issue is classified as CWE-787 (Out-of-bounds Write) by NIST and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) by Talos (NVD).

If exploited, the vulnerability can lead to memory corruption due to heap-based buffer overflow, potentially allowing an attacker to execute arbitrary code. The multi-threaded nature of GTKWave increases the potential impact of this memory corruption (Talos).

The vulnerability has been fixed in GTKWave version 3.3.118. Various Linux distributions have released security updates to address this vulnerability, including Debian which has released updates for both bullseye (3.3.104+really3.3.118-0+deb11u1) and bookworm (3.3.118-0.1~deb12u1) distributions (Debian Security).