OESA-2026-4220

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-4220

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-4220.json

JSON Data

https://api.test.osv.dev/v1/vulns/OESA-2026-4220

Upstream

CVE (2)

Published

2026-09-30T13:47:43Z

Modified

2026-10-01T02:00:12Z

Severity

9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

gpsd security update

Details

gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183.

Security Fix(es):

gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.(CVE-2026-58459)

gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.(CVE-2026-60122)

Database specific

{
    "severity": "Critical"
}

References

Affected packages

openEuler:24.03-LTS-SP4 / gpsd

Package

Name: gpsd
Purl: pkg:rpm/openEuler/gpsd&distro=openEuler-24.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.25-6.oe2403sp4

Ecosystem specific

{
    "aarch64": [
        "gpsd-3.25-6.oe2403sp4.aarch64.rpm",
        "gpsd-clients-3.25-6.oe2403sp4.aarch64.rpm",
        "gpsd-debuginfo-3.25-6.oe2403sp4.aarch64.rpm",
        "gpsd-debugsource-3.25-6.oe2403sp4.aarch64.rpm",
        "gpsd-devel-3.25-6.oe2403sp4.aarch64.rpm",
        "gpsd-libs-3.25-6.oe2403sp4.aarch64.rpm",
        "gpsd-qt-3.25-6.oe2403sp4.aarch64.rpm",
        "gpsd-qt-devel-3.25-6.oe2403sp4.aarch64.rpm",
        "gpsd-xclients-3.25-6.oe2403sp4.aarch64.rpm",
        "python3-gpsd-3.25-6.oe2403sp4.aarch64.rpm"
    ],
    "src": [
        "gpsd-3.25-6.oe2403sp4.src.rpm"
    ],
    "x86_64": [
        "gpsd-3.25-6.oe2403sp4.x86_64.rpm",
        "gpsd-clients-3.25-6.oe2403sp4.x86_64.rpm",
        "gpsd-debuginfo-3.25-6.oe2403sp4.x86_64.rpm",
        "gpsd-debugsource-3.25-6.oe2403sp4.x86_64.rpm",
        "gpsd-devel-3.25-6.oe2403sp4.x86_64.rpm",
        "gpsd-libs-3.25-6.oe2403sp4.x86_64.rpm",
        "gpsd-qt-3.25-6.oe2403sp4.x86_64.rpm",
        "gpsd-qt-devel-3.25-6.oe2403sp4.x86_64.rpm",
        "gpsd-xclients-3.25-6.oe2403sp4.x86_64.rpm",
        "python3-gpsd-3.25-6.oe2403sp4.x86_64.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-4220.json"