Description
gpsd versions 2.90 to 3.17 and microjson versions 1.0 to 1.3, an open source project, allow a stack-based buffer overflow, which may allow remote attackers to execute arbitrary code on embedded platforms via traffic on Port 2947/TCP or crafted JSON inputs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ICS-CERT | gpsd and microjson (Open Source Project) | gpsd versions 2.90 to 3.17 and microjson versions 1.0 to 1.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gpsd | 3.17-6 | — |
| Debian 13 | gpsd | 3.17-6 | — |
| Debian 12 | gpsd | 3.17-6 | — |
| Debian 9 | gpsd | 3.16-4+deb9u1 | DLA-2795-1 |
| Debian 8 | gpsd | 3.11-3+deb8u1 | DLA-1738-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | gpsd | No fix yet | — |
| Ubuntu 16.04 LTS | gpsd | No fix yet | — |
Advisories 3
- DLA-1738-1 gpsd - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2795-1 gpsd - security update Debian Security (DSA / DLA) · Mar 9, 2026
- ICSA-18-310-01 gpsd Open Source Project CISA ICS & IT advisories · Feb 14, 2019
References
- 107029 vdb-entry
- https://ics-cert.us-cert.gov/advisories/ICSA-18-310-01
- [debian-lts-announce] 20190330 [SECURITY] [DLA 1738-1] gpsd security update mailing-list
- GLSA-202009-17 vendor-advisory
- [debian-lts-announce] 20211029 [SECURITY] [DLA 2795-1] gpsd security update mailing-list