{"schema_version":"1.7.2","id":"OESA-2026-3034","modified":"2026-07-19T03:48:15Z","published":"2026-07-19T03:48:15Z","upstream":["CVE-2025-67268","CVE-2025-67269"],"summary":"gpsd security update","details":"gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer.  With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data.  Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183.\r\n\r\nSecurity Fix(es):\n\ngpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.(CVE-2025-67268)\n\nAn integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67199da7`. When parsing a NAVCOM packet, the payload length is calculated using `lexer->length = (size_t)c - 4` without checking if the input byte `c` is less than 4. This results in an unsigned integer underflow, setting `lexer->length` to a very large value (near `SIZE_MAX`). The parser then enters a loop attempting to consume this massive number of bytes, causing 100% CPU utilization and a Denial of Service (DoS) condition.(CVE-2025-67269)","affected":[{"package":{"ecosystem":"openEuler:24.03-LTS-SP3","name":"gpsd","purl":"pkg:rpm/openEuler/gpsd&distro=openEuler-24.03-LTS-SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.25-3.oe2403sp3"}]}],"ecosystem_specific":{"aarch64":["gpsd-3.25-3.oe2403sp3.aarch64.rpm","gpsd-clients-3.25-3.oe2403sp3.aarch64.rpm","gpsd-debuginfo-3.25-3.oe2403sp3.aarch64.rpm","gpsd-debugsource-3.25-3.oe2403sp3.aarch64.rpm","gpsd-devel-3.25-3.oe2403sp3.aarch64.rpm","gpsd-libs-3.25-3.oe2403sp3.aarch64.rpm","gpsd-qt-3.25-3.oe2403sp3.aarch64.rpm","gpsd-qt-devel-3.25-3.oe2403sp3.aarch64.rpm","gpsd-xclients-3.25-3.oe2403sp3.aarch64.rpm","python3-gpsd-3.25-3.oe2403sp3.aarch64.rpm"],"src":["gpsd-3.25-3.oe2403sp3.src.rpm"],"x86_64":["gpsd-3.25-3.oe2403sp3.x86_64.rpm","gpsd-clients-3.25-3.oe2403sp3.x86_64.rpm","gpsd-debuginfo-3.25-3.oe2403sp3.x86_64.rpm","gpsd-debugsource-3.25-3.oe2403sp3.x86_64.rpm","gpsd-devel-3.25-3.oe2403sp3.x86_64.rpm","gpsd-libs-3.25-3.oe2403sp3.x86_64.rpm","gpsd-qt-3.25-3.oe2403sp3.x86_64.rpm","gpsd-qt-devel-3.25-3.oe2403sp3.x86_64.rpm","gpsd-xclients-3.25-3.oe2403sp3.x86_64.rpm","python3-gpsd-3.25-3.oe2403sp3.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3034"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67268"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67269"}],"database_specific":{"severity":"High"}}