gpsd: Arbitrary code execution A vulnerability in gpsd could allow remote code execution. gpsd 2020-09-29 2020-09-29 743766 remote 3.18 3.18

gpsd is a GPS daemon and library for USB/serial GPS devices and GPS/mapping clients.

A stack-based buffer overflow was discovered in gpsd on port 2947/TCP or crafted JSON inputs.

A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service condition.

There is no known workaround at this time.

All gpsd users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=sci-geosciences/gpsd-3.18"
CVE-2018-17937 sam_c sam_c