https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 01:47:03 +0000 https://db.gcve.eu/vuln/alsa-2026:65162 <p><strong>Affected:</strong> AlmaLinux:10: gpsd, AlmaLinux:10: gpsd-clients, AlmaLinux:10: python3-gpsd</p> <p>gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. The AlmaLinux support for this package is limited. See &lt;https://access.AlmaLinux.com/support/policy/gpsd-support&gt; for more details.</p> <p>Security Fix(es):</p> <p>* gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility (CVE-2026-60122)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:10: gpsd, AlmaLinux:10: gpsd-clients, AlmaLinux:10: python3-gpsd</p> <p>gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. The AlmaLinux support for this package is limited. See &lt;https://access.AlmaLinux.com/support/policy/gpsd-support&gt; for more details.</p> <p>Security Fix(es):</p> <p>* gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility (CVE-2026-60122)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://db.gcve.eu/vuln/alsa-2026:65162 https://db.gcve.eu/vuln/fkie_cve-2026-60122 <p>gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.</p> <p>gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.</p> https://db.gcve.eu/vuln/fkie_cve-2026-60122 https://db.gcve.eu/vuln/ghsa-9m96-crvq-5qcj <p>gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.</p> <p>gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.</p> https://db.gcve.eu/vuln/ghsa-9m96-crvq-5qcj https://db.gcve.eu/vuln/rhsa-2026:65162 <p>security update for gpsd</p> <p>security update for gpsd</p> https://db.gcve.eu/vuln/rhsa-2026:65162 https://db.gcve.eu/vuln/ubuntu-cve-2026-60122 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: gpsd, Ubuntu:18.04:LTS: gpsd, Ubuntu:20.04:LTS: gpsd, Ubuntu:22.04:LTS: gpsd, Ubuntu:24.04:LTS: gpsd, Ubuntu:26.04:LTS: gpsd</p> <p>gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: gpsd, Ubuntu:18.04:LTS: gpsd, Ubuntu:20.04:LTS: gpsd, Ubuntu:22.04:LTS: gpsd, Ubuntu:24.04:LTS: gpsd, Ubuntu:26.04:LTS: gpsd</p> <p>gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-60122