CVE-2023-39444: 
NixOS vulnerability analysis and mitigation

Multiple out-of-bounds write vulnerabilities exist in the LXT2 parsing functionality of GTKWave 3.3.115. The vulnerability, identified as CVE-2023-39444, was discovered in January 2024 and affects the string copy loop functionality. A victim would need to open a malicious .lxt2 file to trigger these vulnerabilities, which could lead to arbitrary code execution (Talos, NVD).

The vulnerability has a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue specifically concerns the out-of-bounds write performed by the string copy loop in the LXT2 parsing functionality. The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) (NVD).

The successful exploitation of this vulnerability could lead to arbitrary code execution on the targeted system. The vulnerability affects the confidentiality, integrity, and availability of the system with high severity impacts (Talos).

The vulnerability has been patched in GTKWave version 3.3.118. Users are advised to upgrade to this version or later to mitigate the risk. The fix has been included in various distribution updates, including Debian's security updates (Debian LTS).