[SECURITY] [DLA 4441-1] gpsd security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
From: Bastien Roucariès <rouca@debian.org>
To: debian-lts-announce@lists.debian.org
Subject: [SECURITY] [DLA 4441-1] gpsd security update
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4441-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Bastien Roucariès
January 19, 2026 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : gpsd
Version : 3.22-4+deb11u1
CVE ID : CVE-2025-67268 CVE-2025-67269
Debian Bug : 1124799 1124800
Multiple vulnerabilities were fixed in gpsd a service daemon that
monitors one or more GNSS (GPS) or AIS receivers attached to a host computer
through serial or USB ports.
CVE-2025-67268
gpsd contains a heap-based out-of-bounds write
vulnerability in the drivers/driver_nmea2000.c file.
The hnd_129540 function, which handles NMEA2000 PGN 129540
(GNSS Satellites in View) packets, fails to validate the
user-supplied satellite count against the size of the skyview
array (184 elements). This allows an attacker to write beyond
the bounds of the array by providing a satellite count up
to 255, leading to memory corruption, Denial of Service (DoS),
and potentially arbitrary code execution.
CVE-2025-67269
An integer underflow vulnerability exists in the `nextstate()`
function in `gpsd/packet.c`.
When parsing a NAVCOM packet, the payload length is calculated
using `lexer->length = (size_t)c - 4` without checking if
the input byte `c` is less than 4. This results in an unsigned
integer underflow, setting `lexer->length` to a very large value
(near `SIZE_MAX`). The parser then enters a loop attempting to
consume this massive number of bytes, causing 100% CPU utilization
and a Denial of Service (DoS) condition.
For Debian 11 bullseye, these problems have been fixed in version
3.22-4+deb11u1.
We recommend that you upgrade your gpsd packages.
For the detailed security status of gpsd please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/gpsd
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmlteZcACgkQADoaLapB
CF8izw//Z43T0qHBgvpGAxgDvgWZIUxxhua6t7+0/fAv5RigQGZU18swvL5aVv5Z
iVt7zslY6OXDmNEcVwFkMxajhpPxp9ZE2wsV9HQv0FGCnSAG5I8s3qonpGAYnwpm
SugCflg36+SZiXHBYBkxXQLdLyhHUhp6XSKGdFlANNvX+DjxPrGWd+Eqla6dsnWR
2Bsl1IBeUzJKVRAdW1JYKDvaZRs6c0oEX272GXiVcK+FsdF2EFPOtX+D9As6cP2z
hWttjNUpHIrZcIrCGTjxA/Vh0nRWyQTWLHtEmqpGhYZU/CGc12jwnof9rbHv+Alt
lWVxYrr4kqt9MnxeDWoVVf/VXkD+cjvOhG3+LF7UwokeJNvhxfQG8ke3IcZzJinf
TOtbiVYzUl/hHkUvqYzmQ4/nWn7P5S34PmTwPnxAgKm1td2Te80U2/nXBWPsmihR
Blu/05wCtBK6dewLaeBT0lqNvTY4yGJZ7ebgjk7M/7jBVwdnC4KOzQMZQR5K7edY
WICUPc7ZOAN7MsB8LGOE/+CA+Cr3fAQXccxC5o8Og6EB086XKVW1NiMQot4H+ZBw
ILhJQRcI+JqhK5znk1DQxxJ6Su6OWJYgpJnlXaeaQnArhaXtEJi3Zz+rWB+a9mUQ
YETUV8YJL88zqsrAii4To20YZfjDPuXqUaE9TbyABFg1jWnwT9k=
=OXfL
-----END PGP SIGNATURE-----
Reply to: