Vulnerability · Published Jan 8, 2024 · Assigned by talos
CVE-2023-35960
High 7.8
In plain English
A high-severity OS command injection in GTKWave from GTKWave. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns legacy decompression in `vcd_main`.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | gtkwave | 3.3.118-0.1~deb12u1 | DEBIAN-CVE-2023-35960 |
| Debian:12 | gtkwave | 3.3.118-0.1~deb12u1 | DSA-5653-1 |
| Debian:13 | gtkwave | 3.3.118-0.1 | DEBIAN-CVE-2023-35960 |
| Debian:14 | gtkwave | 3.3.118-0.1 | DEBIAN-CVE-2023-35960 |
| Ubuntu:22.04:LTS | gtkwave | no fix listed | UBUNTU-CVE-2023-35960 |
| Ubuntu:24.04:LTS | gtkwave | no fix listed | UBUNTU-CVE-2023-35960 |
| Ubuntu:25.10 | gtkwave | no fix listed | UBUNTU-CVE-2023-35960 |
| Ubuntu:26.04:LTS | gtkwave | no fix listed | UBUNTU-CVE-2023-35960 |
| Ubuntu:26.10 | gtkwave | no fix listed | UBUNTU-CVE-2023-35960 |
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H