CVE-2023-43628

An integer underflow vulnerability exists in the NTRIP Stream Parsing functionality of GPSd 3.25.1dev. A specially crafted network packet can lead to memory corruption. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2023-43628

CVE-2023-43628 affects GPSd 3.25.1~dev, with an integer underflow in the NTRIP Stream Parsing path that can cause memory corruption when processing crafted network packets. Talos’ analysis documents the vulnerability as an access/memory corruption issue in GPSd’s NTRIP client, triggered by a malf...

CVE-2023-43628

An integer underflow vulnerability exists in the NTRIP Stream Parsing functionality of GPSd 3.25.1dev. A specially crafted network packet can lead to memory corruption. An attacker can send a malicious packet to trigger this vulnerability...

PT-2023-28885

Name of the Vulnerable Software and Affected Versions GPSd version 3.25.1dev Description An integer underflow vulnerability exists in the NTRIP Stream Parsing functionality. A specially crafted network packet can lead to memory corruption. An attacker can send a malicious packet to trigger this...

CVE-2023-43628: Integer Underflow (Wrap or Wraparound)

An integer underflow vulnerability exists in the NTRIP Stream Parsing functionality of GPSd 3.25.1dev. A specially crafted network packet can lead to memory corruption. An attacker can send a malicious packet to trigger this vulnerability...

GPSd NTRIP Stream Parsing access violation vulnerability

Talos Vulnerability Report TALOS-2023-1860 GPSd NTRIP Stream Parsing access violation vulnerability December 5, 2023 CVE Number CVE-2023-43628 SUMMARY An integer underflow vulnerability exists in the NTRIP Stream Parsing functionality of GPSd 3.25.1dev. A specially crafted network packet can lead...

new package: gpsd-minimal

An update is available for gpsd-minimal. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The gpsd package provides a service daemon that mediates access to a GPS...

gpsd:FuzzPacket: Stack-buffer-overflow in crc24q_check

Project: https://gitlab.com/gpsd/gpsd.git Detailed Report: https://oss-fuzz.com/testcase?key=6730139151761408 Project: gpsd Fuzzing Engine: libFuzzer Fuzz Target: FuzzPacket Job Type: libfuzzerasangpsd Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address: 0x7ffc9eabe128 Crash...

SUSE CVE-2018-17937

gpsd versions 2.90 to 3.17 and microjson versions 1.0 to 1.3, an open source project, allow a stack-based buffer overflow, which may allow remote attackers to execute arbitrary code on embedded platforms via traffic on Port 2947/TCP or crafted JSON inputs...

gpsd:FuzzLibgps: Use-of-uninitialized-value in gps_unpack

Project: https://gitlab.com/gpsd/gpsd.git Detailed Report: https://oss-fuzz.com/testcase?key=4622383801827328 Project: gpsd Fuzzing Engine: libFuzzer Fuzz Target: FuzzLibgps Job Type: libfuzzermsangpsd Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: gpsunpack...

gpsd:FuzzJson: Use-after-poison in json_internal_read_object

Project: https://gitlab.com/gpsd/gpsd.git Detailed Report: https://oss-fuzz.com/testcase?key=4919267284090880 Project: gpsd Fuzzing Engine: afl Fuzz Target: FuzzJson Job Type: aflasangpsd Platform Id: linux Crash Type: Use-after-poison READ 1 Crash Address: 0x7f4cc55fd01b Crash State:...

CVE-2018-17937

gpsd versions 2.90 to 3.17 and microjson versions 1.0 to 1.3, an open source project, allow a stack-based buffer overflow, which may allow remote attackers to execute arbitrary code on embedded platforms via traffic on Port 2947/TCP or crafted JSON inputs...

Mageia: Security Advisory (MGASA-2019-0150)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2021-0411)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-2795-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2795-1] gpsd security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2795-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk October 29, 2021 https://wiki.debian.org/LTS -...

Debian DLA-2795-1 : gpsd - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2795 advisory. A security vulnerability was discovered in gpsd, the Global Positioning System daemon. A stack-based buffer overflow may allow remote attackers to execute arbitrary code vi...

DLA-2795-1 gpsd - security update

Bulletin has no description...

A bug is about to confuse a lot of computers by turning back time 20 years

For those of you that remember the fuss about the Y2K bug, this story may sound familiar. The Cybersecurity & Infrastructure Security Agency CISA has issued a warning to Critical Infrastructure CI owners and operators, and other users who get the time from GPS, about a GPS Daemon GPSD bug in GPSD...

GPS Daemon (GPSD) Rollover Bug

Critical Infrastructure CI owners and operators, and other users who obtain Coordinated Universal Time UTC from Global Positioning System GPS devices, should be aware of a GPS Daemon GPSD bug in GPSD versions 3.20 released December 31, 2019 through 3.22 released January 8, 2021. On October 24,...