CVE-2023-39317: 
NixOS vulnerability analysis and mitigation

Multiple integer overflow vulnerabilities exist in the LXT2 num_dict_entries functionality of GTKWave 3.3.115. The vulnerability specifically affects the integer overflow when allocating the string_lens array. A victim would need to open a malicious .lxt2 file to trigger these vulnerabilities (Talos, NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue occurs in the allocation of the string_lens array where an integer overflow can occur in 32-bit mode when calculating the size for memory allocation. The vulnerability is classified as CWE-190 (Integer Overflow or Wraparound) (Talos).

If successfully exploited, this vulnerability could lead to arbitrary code execution on the target system when a malicious .lxt2 file is opened (NVD, Talos).

The vulnerability has been fixed in GTKWave version 3.3.118. Users are recommended to upgrade to this version or later. The fix has been backported to various distributions including Debian 10 (buster) as version 3.3.98+really3.3.118-0+deb10u1 (Debian LTS).