[ GLSA 202009-17 ] gpsd

[GLSA]

Gentoo Linux Security Advisory

Title: gpsd: Arbitrary code execution (GLSA 202009-17)
Severity: normal
Exploitable: remote
Date: 2020-09-29
Bug(s): #743766
ID: 202009-17

Synopsis

A vulnerability in gpsd could allow remote code execution.

Background

gpsd is a GPS daemon and library for USB/serial GPS devices and
GPS/mapping clients.


Affected Packages

Package: sci-geosciences/gpsd
Vulnerable: < 3.18
Unaffected: >= 3.18
Architectures: All supported architectures


Description

A stack-based buffer overflow was discovered in gpsd on port 2947/TCP or
crafted JSON inputs.


Impact

A remote attacker could possibly execute arbitrary code with the
privileges of the process, or cause a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All gpsd users should upgrade to the latest version: