-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 18 Jan 2026 12:45:58 +0100 Source: gpsd Binary: gpsd gpsd-clients gpsd-clients-dbgsym gpsd-dbgsym gpsd-tools gpsd-tools-dbgsym libgps-dev libgps28 libgps28-dbgsym libqgpsmm-dev libqgpsmm28 libqgpsmm28-dbgsym python3-gps python3-gps-dbgsym Architecture: mipsel Version: 3.22-4.1+deb12u1 Distribution: bookworm Urgency: medium Maintainer: mipsel Build Daemon (mipsel-osuosl-04) Changed-By: Bastien Roucariès Description: gpsd - Global Positioning System - daemon gpsd-clients - Global Positioning System - clients gpsd-tools - Global Positioning System - tools libgps-dev - Global Positioning System - development files libgps28 - Global Positioning System - library libqgpsmm-dev - Global Positioning System - Qt wrapper for libgps (development) libqgpsmm28 - Global Positioning System - Qt wrapper for libgps python3-gps - Global Positioning System - Python 3 libraries Closes: 1124799 1124800 Changes: gpsd (3.22-4.1+deb12u1) bookworm; urgency=medium . * Non-Maintainer Upload by LTS team * Remove BD: makedev, breaks debusine * Fix CVE-2025-67268 (Closes: #1124800). gpsd contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution. * Fix CVE-2025-67269 (Closes: #1124799). An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c`. When parsing a NAVCOM packet, the payload length is calculated using `lexer->length = (size_t)c - 4` without checking if the input byte `c` is less than 4. This results in an unsigned integer underflow, setting `lexer->length` to a very large value (near `SIZE_MAX`). The parser then enters a loop attempting to consume this massive number of bytes, causing 100% CPU utilization and a Denial of Service (DoS) condition. Checksums-Sha1: 2978e9d9b8728785545a1890f3f5ca2a02e9a100 1734436 gpsd-clients-dbgsym_3.22-4.1+deb12u1_mipsel.deb f536be20ba13477a013f05c2972d4e5372f1bceb 449420 gpsd-clients_3.22-4.1+deb12u1_mipsel.deb 8f9e68360ee2f19a7a389a657e811f40058b82fd 1992904 gpsd-dbgsym_3.22-4.1+deb12u1_mipsel.deb cb7b10a4ba6446868856fc77ec5fc624b4614c85 1241400 gpsd-tools-dbgsym_3.22-4.1+deb12u1_mipsel.deb 03671bb17ca10d58b386bceb869ed4b5449fd918 285760 gpsd-tools_3.22-4.1+deb12u1_mipsel.deb d8169859ecee30e48de3e6f3b420a680d5ead9f9 20945 gpsd_3.22-4.1+deb12u1_mipsel-buildd.buildinfo e35387382f83dd71d05cded7c5652463abd45488 371472 gpsd_3.22-4.1+deb12u1_mipsel.deb 14379b2ff65d136e3022159b8de4528c880d4019 139776 libgps-dev_3.22-4.1+deb12u1_mipsel.deb 4fc2ad456ec7f0f5346ba2cd2b6c1db51c6a314c 155352 libgps28-dbgsym_3.22-4.1+deb12u1_mipsel.deb ad1574ac441c5959180e35d98438cf335aac3c38 80228 libgps28_3.22-4.1+deb12u1_mipsel.deb a77c30796ee24ce6b7125ccb7ec53e7996dfdd4d 30288 libqgpsmm-dev_3.22-4.1+deb12u1_mipsel.deb 8b4e6ba1bbc36cc595131d55befab55418b0bb0c 377712 libqgpsmm28-dbgsym_3.22-4.1+deb12u1_mipsel.deb 1315b7608e2f0ff7a83b7a77b04de4529c1eb9c2 83996 libqgpsmm28_3.22-4.1+deb12u1_mipsel.deb 33724f05788ccdde302f76af2f967058e7349c2c 62544 python3-gps-dbgsym_3.22-4.1+deb12u1_mipsel.deb 1382228d974f5abed70e91b914b13dd239567799 134912 python3-gps_3.22-4.1+deb12u1_mipsel.deb Checksums-Sha256: 60a0dd1ce342169e1bac431d42ac6ec3aa6489dcf597fe2b9d94a60fcb90076a 1734436 gpsd-clients-dbgsym_3.22-4.1+deb12u1_mipsel.deb faaebb9895f714f9950d211f1d402cdbdcc9d8a5bb4c5e37fffc20aaf8cd9c7c 449420 gpsd-clients_3.22-4.1+deb12u1_mipsel.deb 70b312e696ae0eed38c37a6b798f827e1b04f979edf26053bb453d205503fd6e 1992904 gpsd-dbgsym_3.22-4.1+deb12u1_mipsel.deb d540c388511d16d7e98d4a9227a716aa6df80216e9184530577134baa5221d07 1241400 gpsd-tools-dbgsym_3.22-4.1+deb12u1_mipsel.deb fa83a1c3e3afc970a5321b83b10f4979ec9535b4e090fd591ce0770451207f59 285760 gpsd-tools_3.22-4.1+deb12u1_mipsel.deb ce3c4003bd69119f65336881600d4a9533836e95ec6ebb9fc2b0b03cdd5334f2 20945 gpsd_3.22-4.1+deb12u1_mipsel-buildd.buildinfo 62d5be7e0a35c39b0e95d77c290da4cf6b0dc3bb0afc0a1e2877f91301bee7e3 371472 gpsd_3.22-4.1+deb12u1_mipsel.deb 703529d84f4eabcc4cef3b788f23fe96432d7233c4ec01660fad909c14cef810 139776 libgps-dev_3.22-4.1+deb12u1_mipsel.deb 6358ceb5d1444cbe46073db3bfb338d2ece42a562f2e4010808d4509020c18b9 155352 libgps28-dbgsym_3.22-4.1+deb12u1_mipsel.deb 0868df0f876e978f72163457197e36da76295364ba6bc0184c07a5bd36c5d9ee 80228 libgps28_3.22-4.1+deb12u1_mipsel.deb 94fb4358998d5d75cf9c54e9ae31981d7a571411637e812f6bd0b614c162204d 30288 libqgpsmm-dev_3.22-4.1+deb12u1_mipsel.deb b13a5d9b8288e2e6dbb848b2c2feca1d49ba9bc231c4ef830ef728e7d968274d 377712 libqgpsmm28-dbgsym_3.22-4.1+deb12u1_mipsel.deb 8061fb49847cd35c73bf5f01b5d9b41d2776e15b6c4b17ec5cc6f04ef753f264 83996 libqgpsmm28_3.22-4.1+deb12u1_mipsel.deb a83d55241368a12628c724d5bf933d54dd08801e50411dd950f7c751b98aae2b 62544 python3-gps-dbgsym_3.22-4.1+deb12u1_mipsel.deb 4219b4f781a2a84ed0b82fc519165e2b13b84051729d7697c452bff74160ffe2 134912 python3-gps_3.22-4.1+deb12u1_mipsel.deb Files: 24a054f22d31867d6739cb3e25ebeb28 1734436 debug optional gpsd-clients-dbgsym_3.22-4.1+deb12u1_mipsel.deb 4e76206e7fc43239c618e9cc45b782fe 449420 misc optional gpsd-clients_3.22-4.1+deb12u1_mipsel.deb 610c97cf531169b91fd29744f314377f 1992904 debug optional gpsd-dbgsym_3.22-4.1+deb12u1_mipsel.deb fb2d503249f836bb2b283ae0e350b37d 1241400 debug optional gpsd-tools-dbgsym_3.22-4.1+deb12u1_mipsel.deb 1bf60f107942aa07c666439b43b0ea63 285760 misc optional gpsd-tools_3.22-4.1+deb12u1_mipsel.deb cf69eb3da63dd22942087e9c11574530 20945 misc optional gpsd_3.22-4.1+deb12u1_mipsel-buildd.buildinfo 40c4f9ef1b3c5ce65d4d76faed68e81e 371472 misc optional gpsd_3.22-4.1+deb12u1_mipsel.deb 013aecf99775db5816dd4bc45589b1dc 139776 libdevel optional libgps-dev_3.22-4.1+deb12u1_mipsel.deb f4e6fed0790f86d40d9f76b34745c9c1 155352 debug optional libgps28-dbgsym_3.22-4.1+deb12u1_mipsel.deb 353416bd70bb6f6e345277ac808ae531 80228 libs optional libgps28_3.22-4.1+deb12u1_mipsel.deb 0b74460cf61c9098f648bb7c1c54e36d 30288 libdevel optional libqgpsmm-dev_3.22-4.1+deb12u1_mipsel.deb 40cb42a97dd4dbdb01f7abf5c8086470 377712 debug optional libqgpsmm28-dbgsym_3.22-4.1+deb12u1_mipsel.deb 2035411311aba814879be5489a9cbb52 83996 libs optional libqgpsmm28_3.22-4.1+deb12u1_mipsel.deb 2cad63657a703f58275bfed5112daca0 62544 debug optional python3-gps-dbgsym_3.22-4.1+deb12u1_mipsel.deb dd1c98a582abcd92c4ce9b2d85f36193 134912 python optional python3-gps_3.22-4.1+deb12u1_mipsel.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEyYUQCyzsgu940OiVpwP2OD8jZaoFAmn2gewACgkQpwP2OD8j ZaozHg/+P6fNLAJQcjwLIqJcjKQyF1ptG56ctqpvqYvGprQ9XY+ECckQ9Pu4j7CX jxwZLYb0bD9EVojVHBG4Wr6QIvI9wCBZkoWZo47oGQJKY8AwDac/1NIWgbsNClxn jFQPoLkRqOlWZBR7QNe1bWIc+a3lOib2Lo1cELm4L7/Z4Cs0s2LOWZ0N/eqaduRX 9+iFVxrN5ZTNMKkyHfFWMEfPvp9YHO2sFwUN7pH6IW68DGTXA77ifs/8Jm0GeNBG omDwWRglVKXaQCeYb+1H68C9jtH0yc/MppWjngtnC/elOut4jktiwIDmjvM7kf8z hF9jjS72UOtvTwnUteu7w6ZkgwTJD0AsoP1ACdhc53X02Tdj787kzoJJZiNK9nQT GjkVnpTY0qSXrCnE7jq86dkZi0G7GJ2s/JbdeN6jhibyOd1K5ccj55tP/F3Qo0uv 5ohekgMEhrCiVhlnjanqFNAz5Up8aRhmDu3E71Dl5yFdMZ+DoGnZzwxA4gDlNj4v oNvxHZCdGSYYacch2ICYoSFZIahq9R+hnHqRGMx7JIK0MQilSnjwkvLS1meJHrZa cVQhfqUtRUtc6a1t8jhsEUJJFd0a5okxWq3ZBbS3jq0+v0Lc6zg7w8BUuzfUxl44 TSSsy6WkFDYjn20VO2AxSNNB+4x31pQj39XTBWOTfDdAUc2tnmg= =0DwQ -----END PGP SIGNATURE-----