Summary
[3.26.1-2.0.1.el9_8.1]
- Replaced upstream reference [Orabug: 35865525]
[1:3.26.1-2.el9_8.1]
- fix command injection in gpsprof (CVE-2026-58459)
[1:3.26.1-2]
- fix buffer overflow in NMEA2000 driver (CVE-2025-67268)
- fix integer underflow in handling of Navcom packets (CVE-2025-67269)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | gpsd-minimal | 1:3.26.1-2.0.1.el9_8.1 |
| Oracle Linux · 9 | gpsd-minimal-clients | 1:3.26.1-2.0.1.el9_8.1 |
Vulnerabilities 1
-
High 7.8
gpsd gpsprof Command Injection via gnuplot plot title subtype field
gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot t…