Debian Patches

Status for gpsd/3.25-5+deb13u2

Patch Description Author Forwarded Bugs Origin Last update
systemd-documentation.patch add documentation
A simple man page reference		 Boian Bonev <bbonev@ipacct.com> no 2023-05-16
full-systemd-support Debianize gpsd.service.in no
gpsd_hotplug_rules_disable_generic_serial_converters Disable hotplugging of ftdi/pl2302 usb<>serial adapters.
These adapters are too common to hit them with the gpsd hotplug script.		 no debian
ignore-test-xgps_deps_check Ignore the build-time test for xgps deps.
We'll deliver them as dependency, no worries.		 Bernd Zeimetz <bzed@debian.org> no 2020-01-02
desktop-add-keywords.patch add keywords and remove encoding
Fix lintian warnings:
- desktop-entry-contains-encoding-key
- desktop-entry-lacks-keywords-entry		 Boian Bonev <bbonev@ipacct.com> no 2020-07-21
man-page-typos.patch Fix spelling
Fix spelling mistakes in man pages		 Boian Bonev <bbonev@ipacct.com> yes 2023-05-15
build-on-hurd.patch Get rid of PATH_MAX Boian Bonev <bbonev@ipacct.com> invalid 2023-06-20
CVE-2025-67268.patch drivers/driver_nmea2000.c: Fix issue 356, skyview buffer overrun. "Gary E. Miller" <gem@rellim.com> no https://gitlab.com/gpsd/gpsd/-/commit/dc966aa74c075d0a6535811d98628625cbfbe3f4 2026-01-17
CVE-2025-67269.patch gpsd/packet.c: Fix integer underflow is malicious Navcom packet

Causes DoS. Fix issue 358		 "Gary E. Miller" <gem@rellim.com> no debian backport, https://gitlab.com/gpsd/gpsd/-/commit/ffa1d6f40bca0b035fc7f5e563160ebb67199da7 2025-12-03
CVE-2026-58459.patch gpsprof: quote double quotes and back ticks in title and terminal
gpsd through release-3.27.5 contains a command injection vulnerability in
gpsprof that allows attackers who control the GPS device subtype value to
execute arbitrary shell commands by embedding backtick payloads in the
gnuplot plot title without proper escaping. The subtype field, sourced
from a DEVICES JSON log entry or an NMEA PGRMT sentence, is written into
the generated gnuplot program via a "set title" statement with only double
quote characters escaped, enabling arbitrary shell command execution as the
user running gnuplot when the victim renders the generated plot through the
gpsprof and gnuplot workflow.

Escape ", ` and newline in the plot description, in the title and in the
terminal name before writing them into the gnuplot program.

This is the cumulative upstream fix, squashed from commits 5581ba19,
1a6bb7bc and 4c06658e; the middle commit had a typo that made the back tick
substitution a no-op, corrected by the last one.

Backported to 3.25: line offsets only, the surrounding code is unchanged
between 3.25 and 3.27.5.		 Gary E. Miller <gem@rellim.com> yes debian upstream upstream, https://gitlab.com/gpsd/gpsd/-/commit/4c06658e988f4ced1a7a574ce082a22ef625df56 2026-07-25
CVE-2026-60122.patch gpsprof: ensure sats.used is boolean
gpsd through release-3.27.5 contains a code injection vulnerability in the
gpsprof utility that allows an attacker who controls GPS input data to
execute arbitrary OS commands by injecting malicious content into the
SKY.satellites[].used field, which is inserted unsanitized into a gnuplot
heredoc data block. An attacker can supply a used value containing the
string EOD to terminate the heredoc early and append gnuplot system()
calls, achieving OS command execution as the user running gpsprof when the
generated plot script is processed by gnuplot in polar mode.

Force sat.used to a real boolean so nothing attacker controlled can reach
the generated gnuplot program.

Backported to 3.25: the polarplot hunk needed rebasing, as 3.25 spells the
guard as a single line, "if (('polarused' == self.name) and (sat['used'] is
False)):", where 3.27.5 splits it over two lines. No functional difference.		 Gary E. Miller <gem@rellim.com> yes upstream backport, https://gitlab.com/gpsd/gpsd/-/commit/5a9c44a42136b9bb98d460a8a716e9fd344a8d93 2026-07-25

All known versions for source package 'gpsd'

Links