Threats affecting pkg:github/xschem

xschem versions 2.9.9 through 3.4.7 have a heap out-of-bounds write vulnerability in the read_dataset() function of src/rawtovcd.c. This flaw arises from an unchecked variable index when processing crafted ngspice .raw files, allowing heap memory corruption.

xschem versions 2.9.9 through 3.4.7 have an out-of-bounds read vulnerability in the read_xschem_file() function. This flaw occurs when the software processes embedded-symbol records without a preceding instance, allowing crafted schematic files starting with a "[" record to cause memory reads below the instance array and crash the application.