Your message dated Sat, 25 Jul 2026 22:56:03 +0000
with message-id <[email protected]>
and subject line Bug#1141962: fixed in gpsd 3.27.5-1
has caused the Debian Bug report #1141962,
regarding gpsd: CVE-2026-58459
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1141962: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141962
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: gpsd
Version: 3.27.5-0.1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for gpsd.
CVE-2026-58459[0]:
| gpsd through release-3.27.5, fixed at commit 4c06658, contains a
| command injection vulnerability in gpsprof that allows attackers who
| control the GPS device subtype value to execute arbitrary shell
| commands by embedding backtick payloads in the gnuplot plot title
| without proper escaping. The subtype field sourced from a DEVICES
| JSON log entry or NMEA PGRMT sentence is written into a generated
| gnuplot program via a set title statement with only double-quote
| characters escaped, enabling arbitrary shell command execution as
| the user running gnuplot when the victim renders the generated plot
| through the gpsprof and gnuplot workflow.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-58459
https://www.cve.org/CVERecord?id=CVE-2026-58459
[1] https://gitlab.com/gpsd/gpsd/-/work_items/404#note_3534119267
[2]
https://github.com/ntpsec/gpsd/commit/5581ba196d826a984fbfaf792b7d58535f9911ce
[3]
https://github.com/ntpsec/gpsd/commit/1a6bb7bcbdf58aa940132e630870af061dc88537
[4]
https://github.com/ntpsec/gpsd/commit/4c06658e988f4ced1a7a574ce082a22ef625df56
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: gpsd
Source-Version: 3.27.5-1
Done: Boian Bonev <[email protected]>
We believe that the bug you reported is fixed in the latest version of
gpsd, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Boian Bonev <[email protected]> (supplier of updated gpsd package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 25 Jul 2026 21:16:01 +0000
Source: gpsd
Architecture: source
Version: 3.27.5-1
Distribution: unstable
Urgency: medium
Maintainer: Boian Bonev <[email protected]>
Changed-By: Boian Bonev <[email protected]>
Closes: 1141962
Changes:
gpsd (3.27.5-1) unstable; urgency=medium
.
* Fix CVE-2026-58459 (Closes: #1141962). A command injection
vulnerability exists in the gpsprof client. The subtype field,
sourced from a DEVICES JSON log entry or an NMEA PGRMT sentence, is
written into the generated gnuplot program via a set title statement
with only double quote characters escaped. An attacker who controls
the GPS device subtype can embed backtick payloads and execute
arbitrary shell commands as the user running gnuplot when the
generated plot is rendered.
* Fix CVE-2026-60122. A code injection vulnerability exists in the
gpsprof client. The SKY.satellites[].used field is inserted
unsanitized into a gnuplot heredoc data block. An attacker who
controls the GPS input data can supply a used value containing the
string EOD to terminate the heredoc early and append gnuplot
system() calls, achieving OS command execution as the user running
gpsprof when the generated plot script is processed by gnuplot in
polar mode.
* Bump standards to 4.7.4, no changes
* Bump dh to 14
* Remove redundant prio
Checksums-Sha1:
08e4a9af882c216bd0d68f2be03d646f47922b00 3107 gpsd_3.27.5-1.dsc
0bfe688b8264161b2dad3c55ae08866349a66e8c 50600 gpsd_3.27.5-1.debian.tar.xz
cc797304da114e9842d7ef17cbef2aac67699a27 21027 gpsd_3.27.5-1_amd64.buildinfo
Checksums-Sha256:
74e6b6e323a7099db6e4c78e9a35ea11dc98f818eed85e4a3334ac9036fde2cc 3107
gpsd_3.27.5-1.dsc
be36d737fc0323d3461554abe80ca3a6263740f48c9aec046d353f84021ffcd6 50600
gpsd_3.27.5-1.debian.tar.xz
43e2daa575cce3f05f37c3405bcb70a77d27293c49a3583af87e95eaa4fe63e7 21027
gpsd_3.27.5-1_amd64.buildinfo
Files:
10b0724d7f05cc68c4cfd7eb2dc49c64 3107 misc optional gpsd_3.27.5-1.dsc
c8a64a90969c5587dd38ee7d76674e56 50600 misc optional
gpsd_3.27.5-1.debian.tar.xz
2104bc3d9418d5ab391e7fc806a2f1e5 21027 misc optional
gpsd_3.27.5-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJGBAEBCgAwFiEEumC8IPN+WURNbSUAE2VyCRPS8i0FAmplNcASHGJib25ldkBp
cGFjY3QuY29tAAoJEBNlcgkT0vIty50P/R/3dLaLbK6OUy41/imKaazh1b6miW9/
YRKHux9x7P6GPqSxoeGpyjFoFEU78RandIL5j0xXfjso1ENABpeYrXr48BxUNbyk
zTZ8PJnh5sy+41+vWDVOHL+GubY835I7oU16dqkrXdFsBiCLVZRctimUaeJ9sruK
9gvlrC04mB4cpPxivPG14AYg0RKLWram5CerwpOvuTGDY/1fWNgcV1oDxGfwLQoB
AWMlkYEochUdcCSlfxCUqTCmYcLBi0BM8Dm10JL/ex3+A/tQHf+5alvZ/DmCe9GD
e1aoDQvPBG7fmMk/RU6pi6NOMBCKmUOlL5PEd0T7RcUdRQwnkIVPIw0u/NqfUIh3
JvhrXjFSL+WOXAw0yukSUQuM/Yc37JcjAqs3rQXaLDvuBOrvTHQA+5ooZpEpDDmx
axdZuwubTzK5cMuh7JpcbT06MkUwkvH06Z2O/FI11TXrNnlLZ4ur5bd7KciG6stK
hZLsqb3MMp3ffMZym+P44gehay79Gy5JqZNk8vIsYyaQJM2R94EcTr0xYvorqstF
87BtDmD1dzL1JIfYCZ9czn+lXmS9oBgvhCFGbcM4efFl7XZTBHY+TtTN5ruFjsVt
mtdVaO1lGAC7b9/1q0kNh/y01ruksVLYOhrHhYJ0y3UPpWHCct/eo9dG83rwI7sR
fwwXo+D68OxW
=RPq1
-----END PGP SIGNATURE-----
pgpLD8fOGQakq.pgp
Description: PGP signature
--- End Message ---
