Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:deb/debian/gpsd@2.13-1
purl pkg:deb/debian/gpsd@2.13-1
Next non-vulnerable version 3.22-4.1+deb12u1
Latest non-vulnerable version 3.22-4.1+deb12u1
Risk 4.4
Vulnerabilities affecting this package (4)
Vulnerability Summary Fixed by
VCID-a6w8-srmt-wugb
Aliases:
CVE-2025-67269
An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67199da7`. When parsing a NAVCOM packet, the payload length is calculated using `lexer->length = (size_t)c - 4` without checking if the input byte `c` is less than 4. This results in an unsigned integer underflow, setting `lexer->length` to a very large value (near `SIZE_MAX`). The parser then enters a loop attempting to consume this massive number of bytes, causing 100% CPU utilization and a Denial of Service (DoS) condition.
3.22-4.1+deb12u1
Affected by 0 other vulnerabilities.
VCID-krnc-1xtt-8ubw
Aliases:
CVE-2018-17937
3.17-7
Affected by 2 other vulnerabilities.
VCID-r9sv-yzza-z7bv
Aliases:
CVE-2025-67268
gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.
3.22-4.1+deb12u1
Affected by 0 other vulnerabilities.
VCID-y64a-jq2n-qyf1
Aliases:
CVE-2013-2038
3.9-3~bpo70+1
Affected by 3 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-13T11:52:41.597724+00:00 Debian Oval Importer Affected by VCID-krnc-1xtt-8ubw https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.6.0
2026-06-13T10:00:51.263079+00:00 Debian Oval Importer Affected by VCID-a6w8-srmt-wugb https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.6.0
2026-06-13T08:10:36.764403+00:00 Debian Oval Importer Affected by VCID-r9sv-yzza-z7bv https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.6.0
2026-06-13T05:04:59.046312+00:00 Debian Oval Importer Affected by VCID-y64a-jq2n-qyf1 https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.6.0