CVE-2023-37577: 
NixOS vulnerability analysis and mitigation

Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities. This vulnerability specifically concerns the use-after-free when triggered via the vcd2lxt2 conversion utility (NVD, Talos Report).

The vulnerability exists in the VCD get_vartoken realloc functionality where memory is used after being freed. The issue occurs when parsing VCD files, specifically in the vcd2lxt2 conversion utility. The vulnerability has a CVSS v3.1 Base Score of 7.8 HIGH with vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-416 (Use After Free) (Talos Report).

If successfully exploited, this vulnerability can lead to arbitrary code execution on the target system. The vulnerability requires user interaction, as a victim needs to open a malicious file to trigger the vulnerability (NVD, Talos Report).

The vulnerability has been fixed in GTKWave version 3.3.118. Users are recommended to upgrade to this version or later. Multiple distributions have released security updates to address this vulnerability, including Debian which has released fixes in DLA-3785-1 and DSA-5653-1 (Debian LTS).