CVE-2023-39271: 
NixOS vulnerability analysis and mitigation

Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. The vulnerability, identified as CVE-2023-39271, specifically concerns the integer overflow when allocating the msb array. A victim would need to open a malicious .lxt2 file to trigger these vulnerabilities (Talos, NVD).

The vulnerability occurs in the LXT2 facgeometry parsing functionality where the size for the msb array allocation may wrap around, leading to an out-of-bounds write. The issue affects GTKWave version 3.3.115 and has been assigned a CVSS v3.1 Base Score of 7.8 HIGH with the vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-190 (Integer Overflow or Wraparound) (Talos).

If successfully exploited, this vulnerability can lead to arbitrary code execution on the affected system. The vulnerability has high impacts on confidentiality, integrity, and availability of the system, as indicated by the CVSS scoring (Talos).

The vulnerability has been fixed in GTKWave version 3.3.118. Users are recommended to upgrade to this or later versions. The fix has been included in various distribution updates, including Debian 10 (buster) version 3.3.98+really3.3.118-0+deb10u1 (Debian LTS).