Debian Patches

Status for gpsd/3.27.5-1

Patch Description Author Forwarded Bugs Origin Last update
systemd-documentation.patch add documentation
A simple man page reference		 Boian Bonev <bbonev@ipacct.com> no 2023-05-16
full-systemd-support Debianize gpsd.service.in no
gpsd_hotplug_rules_disable_generic_serial_converters Disable hotplugging of generic usb<>serial adapters.
These adapters are too common to hit them with the gpsd hotplug script.
===================================================================		 no debian
ignore-test-xgps_deps_check Ignore the build-time test for xgps deps.
We'll deliver them as dependency, no worries.

===================================================================		 Bernd Zeimetz <bzed@debian.org> no 2020-01-02
desktop-add-keywords.patch add keywords and remove encoding
Fix lintian warnings:
- desktop-entry-contains-encoding-key
- desktop-entry-lacks-keywords-entry		 Boian Bonev <bbonev@ipacct.com> no 2020-07-21
build-on-hurd.patch Get rid of PATH_MAX

===================================================================		 Boian Bonev <bbonev@ipacct.com> invalid 2023-06-20
CVE-2026-58459.patch gpsprof: quote double quotes and back ticks in title and terminal
gpsd through release-3.27.5 contains a command injection vulnerability in
gpsprof that allows attackers who control the GPS device subtype value to
execute arbitrary shell commands by embedding backtick payloads in the
gnuplot plot title without proper escaping. The subtype field, sourced
from a DEVICES JSON log entry or an NMEA PGRMT sentence, is written into
the generated gnuplot program via a "set title" statement with only double
quote characters escaped, enabling arbitrary shell command execution as the
user running gnuplot when the victim renders the generated plot through the
gpsprof and gnuplot workflow.

Escape ", ` and newline in the plot description, in the title and in the
terminal name before writing them into the gnuplot program.

This is the cumulative upstream fix, squashed from commits 5581ba19,
1a6bb7bc and 4c06658e; the middle commit had a typo that made the back tick
substitution a no-op, corrected by the last one.		 Gary E. Miller <gem@rellim.com> yes debian upstream upstream, https://gitlab.com/gpsd/gpsd/-/commit/4c06658e988f4ced1a7a574ce082a22ef625df56 2026-07-25
CVE-2026-60122.patch gpsprof: ensure sats.used is boolean
gpsd through release-3.27.5 contains a code injection vulnerability in the
gpsprof utility that allows an attacker who controls GPS input data to
execute arbitrary OS commands by injecting malicious content into the
SKY.satellites[].used field, which is inserted unsanitized into a gnuplot
heredoc data block. An attacker can supply a used value containing the
string EOD to terminate the heredoc early and append gnuplot system()
calls, achieving OS command execution as the user running gpsprof when the
generated plot script is processed by gnuplot in polar mode.

Force sat.used to a real boolean so nothing attacker controlled can reach
the generated gnuplot program.		 Gary E. Miller <gem@rellim.com> yes upstream upstream, https://gitlab.com/gpsd/gpsd/-/commit/5a9c44a42136b9bb98d460a8a716e9fd344a8d93 2026-07-25

All known versions for source package 'gpsd'

Links