CVE-2023-38618
published 2024-01-08CVE-2023-38618: Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to…
PriorityP337high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.43%
35.4th percentile
Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `rows` array.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gtkwave | < gtkwave 3.3.118-0.1~deb12u1 (bookworm) | gtkwave 3.3.118-0.1~deb12u1 (bookworm) |
| gtkwave | gtkwave | — | — |
| gtkwave | gtkwave | >= 0 < 3.3.104+really3.3.118-0+deb11u1 | 3.3.104+really3.3.118-0+deb11u1 |
| gtkwave | gtkwave | >= 0 < 3.3.118-0.1~deb12u1 | 3.3.118-0.1~deb12u1 |
| gtkwave | gtkwave | >= 0 < 3.3.118-0.1 | 3.3.118-0.1 |
| gtkwave | gtkwave | >= 0 < 3.3.118-0.1 | 3.3.118-0.1 |
| tonybybell | gtkwave | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
linux-azure-fips vulnerabilities
osv·2025-10-21·CVSS 7.8
linux-azure-fips vulnerabilities
linux-azure-fips vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Network drivers;
- Device tree and open firmware driver;
- SCSI subsystem;
- TTY drivers;
- Ext4 file system;
- Network file system (NFS) server daemon;
- SMB network file system;
- Bluetooth subsystem;
- Packet sockets;
- Network traffic control;
- VMware vSockets driver;
(CVE-2025-38350, CVE-2024-57996, CVE-2025-37752, CVE-2025-38617,
CVE-2025-38477, CVE-2025-38083, CVE-2024-38541, CVE-2023-52757,
CVE-2023-52975, CVE-2025-38618, CVE-2024-49950, CVE-2024-50073,
CVE-2025-37785, CVE-2025-21796, CVE-2025-38683, CVE-2025-37797)
OSV
linux-azure, linux-azure-5.4 vulnerabilities
osv·2025-10-13·CVSS 7.8
linux-azure, linux-azure-5.4 vulnerabilities
linux-azure, linux-azure-5.4 vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Network drivers;
- Device tree and open firmware driver;
- SCSI subsystem;
- TTY drivers;
- Ext4 file system;
- Network file system (NFS) server daemon;
- SMB network file system;
- Bluetooth subsystem;
- Packet sockets;
- Network traffic control;
- VMware vSockets driver;
(CVE-2025-38350, CVE-2024-57996, CVE-2025-37752, CVE-2025-38617,
CVE-2025-38477, CVE-2025-38083, CVE-2024-38541, CVE-2023-52757,
CVE-2023-52975, CVE-2025-38618, CVE-2024-49950, CVE-2024-50073,
CVE-2025-37785, CVE-2025-21796, CVE-2025-38683, CVE-2025-37797)
OSV
CVE-2023-38618: Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3
osv·2024-01-08·CVSS 7.8
CVE-2023-38618 [HIGH] CVE-2023-38618: Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3
Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `rows` array.
GHSA
GHSA-rjfr-rgjj-mvh5: Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3
ghsa_unreviewed·2024-01-08
CVE-2023-38618 [HIGH] CWE-190 GHSA-rjfr-rgjj-mvh5: Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3
Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `rows` array.
Debian
CVE-2023-38618: gtkwave - Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing f...
vendor_debian·2023·CVSS 7.8
CVE-2023-38618 [HIGH] CVE-2023-38618: gtkwave - Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing f...
Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `rows` array.
Scope: local
bookworm: resolved (fixed in 3.3.118-0.1~deb12u1)
bullseye: resolved (fixed in 3.3.104+really3.3.118-0+deb11u1)
forky: resolved (fixed in 3.3.118-0.1)
sid: resolved (fixed in 3.3.118-0.1)
trixie: resolved (fixed in 3.3.118-0.1)
No detection rules found.
No public exploits indexed.
Talos
Critical vulnerability in ManageEngine could lead to file creation, dozens of other vulnerabilities disclosed by Talos to start 2024
blogs_talos·2024-01-17·CVSS 9.1
[CRITICAL] Critical vulnerability in ManageEngine could lead to file creation, dozens of other vulnerabilities disclosed by Talos to start 2024
## Critical vulnerability in ManageEngine could lead to file creation, dozens of other vulnerabilities disclosed by Talos to start 2024
Cisco Talos’ Vulnerability Research team has disclosed dozens of vulnerabilities over the past month, including more than 30 advisories in GTKWave and a critical vulnerability in ManageEngine OpManager.
Cisco ASIG also recently discovered an information disclosure vulnerability in DuoUniversalKeycloakAuthenticator, an authentication solution for Keycloak, an open-source identity and access management solution.
There are also multiple vulnerabilities in AVideo, an open-source video broadcasting suite, that could lead to arbitrary code execution.
All the vulnerabilities mentioned in this blog post have been patched by their respective vendors, all in adh
Talos
Critical vulnerability in ManageEngine could lead to file creation, dozens of other vulnerabilities disclosed by Talos to start 2024
blogs_talos·2024-01-17·CVSS 9.1
[CRITICAL] Critical vulnerability in ManageEngine could lead to file creation, dozens of other vulnerabilities disclosed by Talos to start 2024
Cisco Talos’ Vulnerability Research team has disclosed dozens of vulnerabilities over the past month, including more than 30 advisories in GTKWave and a critical vulnerability in ManageEngine OpManager.
Cisco ASIG also recently discovered an information disclosure vulnerability in DuoUniversalKeycloakAuthenticator, an authentication solution for Keycloak, an open-source identity and access management solution.
There are also multiple vulnerabilities in AVideo, an open-source video broadcasting suite, that could lead to arbitrary code execution.
All the vulnerabilities mentioned in this blog post have been patched by their respective vendors, all in adherence to Cisco’s third-party vulnerability disclosure policy.
For Snort coverage that can detect the exploitation of these vulnerabilit
https://lists.debian.org/debian-lts-announce/2024/04/msg00007.htmlhttps://talosintelligence.com/vulnerability_reports/TALOS-2023-1812https://lists.debian.org/debian-lts-announce/2024/04/msg00007.htmlhttps://talosintelligence.com/vulnerability_reports/TALOS-2023-1812https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1812
2024-01-08
Published