Joined: 12 May 2004
|Posted: Tue Sep 29, 2020 10:26 pm Post subject: [ GLSA 202009-17 ] gpsd
|Gentoo Linux Security Advisory
Title: gpsd: Arbitrary code execution (GLSA 202009-17)
A vulnerability in gpsd could allow remote code execution.
gpsd is a GPS daemon and library for USB/serial GPS devices and
Vulnerable: < 3.18
Unaffected: >= 3.18
Architectures: All supported architectures
A stack-based buffer overflow was discovered in gpsd on port 2947/TCP or
crafted JSON inputs.
A remote attacker could possibly execute arbitrary code with the
privileges of the process, or cause a Denial of Service condition.
There is no known workaround at this time.
All gpsd users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=sci-geosciences/gpsd-3.18"