https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:53:18 +0000 https://cve.radiocsirt.org/vuln/oesa-2026-4230 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP4: wireshark</p> <p>Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless (WiFi or Bluetooth) networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols. Security Fix(es):</p> <p>SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95387)</p> <p>Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95388)</p> <p>SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95389)</p> <p>MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95392)</p> <p>CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95393)</p> <p>Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95394)</p> <p>IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95395)</p> <p>Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96415)</p> <p>IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96416)</p> <p>RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96417)</p> <p>TIFF protocol dissector infinite loop in 4.6…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP4: wireshark</p> <p>Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless (WiFi or Bluetooth) networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols. Security Fix(es):</p> <p>SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95387)</p> <p>Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95388)</p> <p>SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95389)</p> <p>MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95392)</p> <p>CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95393)</p> <p>Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95394)</p> <p>IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95395)</p> <p>Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96415)</p> <p>IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96416)</p> <p>RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96417)</p> <p>TIFF protocol dissector infinite loop in 4.6…</p> https://cve.radiocsirt.org/vuln/oesa-2026-4230 Wed, 30 Sep 2026 13:47:49 +0000 https://cve.radiocsirt.org/vuln/oesa-2026-4229 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP3: wireshark</p> <p>Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless (WiFi or Bluetooth) networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols. Security Fix(es):</p> <p>SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95387)</p> <p>Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95388)</p> <p>SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95389)</p> <p>MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95392)</p> <p>CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95393)</p> <p>Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95394)</p> <p>IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95395)</p> <p>Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96415)</p> <p>IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96416)</p> <p>RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96417)</p> <p>TIFF protocol dissector infinite loop in 4.6…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP3: wireshark</p> <p>Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless (WiFi or Bluetooth) networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols. Security Fix(es):</p> <p>SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95387)</p> <p>Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95388)</p> <p>SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95389)</p> <p>MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95392)</p> <p>CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95393)</p> <p>Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95394)</p> <p>IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95395)</p> <p>Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96415)</p> <p>IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96416)</p> <p>RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96417)</p> <p>TIFF protocol dissector infinite loop in 4.6…</p> https://cve.radiocsirt.org/vuln/oesa-2026-4229 Wed, 30 Sep 2026 13:47:49 +0000 https://cve.radiocsirt.org/vuln/oesa-2026-4228 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: wireshark</p> <p>Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless (WiFi or Bluetooth) networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols. Security Fix(es):</p> <p>SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95387)</p> <p>Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95388)</p> <p>SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95389)</p> <p>MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95392)</p> <p>CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95393)</p> <p>Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95394)</p> <p>IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95395)</p> <p>Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96415)</p> <p>IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96416)</p> <p>RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96417)</p> <p>TIFF protocol dissector infinite loop in 4.6…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: wireshark</p> <p>Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless (WiFi or Bluetooth) networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols. Security Fix(es):</p> <p>SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95387)</p> <p>Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95388)</p> <p>SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95389)</p> <p>MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95392)</p> <p>CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95393)</p> <p>Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95394)</p> <p>IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95395)</p> <p>Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96415)</p> <p>IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96416)</p> <p>RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96417)</p> <p>TIFF protocol dissector infinite loop in 4.6…</p> https://cve.radiocsirt.org/vuln/oesa-2026-4228 Wed, 30 Sep 2026 13:47:48 +0000 https://cve.radiocsirt.org/vuln/oesa-2026-4227 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: wireshark</p> <p>Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless (WiFi or Bluetooth) networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols. Security Fix(es):</p> <p>SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95387)</p> <p>Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95388)</p> <p>SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95389)</p> <p>MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95392)</p> <p>CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95393)</p> <p>Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95394)</p> <p>IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95395)</p> <p>Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96415)</p> <p>IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96416)</p> <p>RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96417)</p> <p>TIFF protocol dissector infinite loop in 4.6…</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: wireshark</p> <p>Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless (WiFi or Bluetooth) networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols. Security Fix(es):</p> <p>SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95387)</p> <p>Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95388)</p> <p>SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95389)</p> <p>MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95392)</p> <p>CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95393)</p> <p>Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95394)</p> <p>IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-95395)</p> <p>Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96415)</p> <p>IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96416)</p> <p>RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service(CVE-2026-96417)</p> <p>TIFF protocol dissector infinite loop in 4.6…</p> https://cve.radiocsirt.org/vuln/oesa-2026-4227 Wed, 30 Sep 2026 13:47:47 +0000 https://cve.radiocsirt.org/vuln/oesa-2026-4226 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP3: flatpak-builder</p> <p>Flatpak-builder is a tool for building flatpaks from sources. Security Fix(es):</p> <p>A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.(CVE-2026-86320)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP3: flatpak-builder</p> <p>Flatpak-builder is a tool for building flatpaks from sources. Security Fix(es):</p> <p>A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.(CVE-2026-86320)</p> https://cve.radiocsirt.org/vuln/oesa-2026-4226 Wed, 30 Sep 2026 13:47:47 +0000 https://cve.radiocsirt.org/vuln/oesa-2026-4225 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: flatpak-builder</p> <p>Flatpak-builder is a tool for building flatpaks from sources. Security Fix(es):</p> <p>A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.(CVE-2026-86320)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: flatpak-builder</p> <p>Flatpak-builder is a tool for building flatpaks from sources. Security Fix(es):</p> <p>A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.(CVE-2026-86320)</p> https://cve.radiocsirt.org/vuln/oesa-2026-4225 Wed, 30 Sep 2026 13:47:46 +0000 https://cve.radiocsirt.org/vuln/oesa-2026-4224 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP4: flatpak-builder</p> <p>Flatpak-builder is a tool for building flatpaks from sources. Security Fix(es):</p> <p>A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.(CVE-2026-86320)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP4: flatpak-builder</p> <p>Flatpak-builder is a tool for building flatpaks from sources. Security Fix(es):</p> <p>A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.(CVE-2026-86320)</p> https://cve.radiocsirt.org/vuln/oesa-2026-4224 Wed, 30 Sep 2026 13:47:45 +0000 https://cve.radiocsirt.org/vuln/oesa-2026-4223 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP4: gimp</p> <p>The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute. Security Fix(es):</p> <p>A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the used_clrs (palette count) parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.(CVE-2026-82328)</p> <p>A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ (compressed) decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.(CVE-2026-82330)</p> <p>A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP4: gimp</p> <p>The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing, and conversions, together with multilevel undo. The GIMP offers a scripting facility, but many of the included scripts rely on fonts that we cannot distribute. Security Fix(es):</p> <p>A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the used_clrs (palette count) parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.(CVE-2026-82328)</p> <p>A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ (compressed) decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.(CVE-2026-82330)</p> <p>A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can…</p> https://cve.radiocsirt.org/vuln/oesa-2026-4223 Wed, 30 Sep 2026 13:47:45 +0000 https://cve.radiocsirt.org/vuln/oesa-2026-4222 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP3: gpsd</p> <p>gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. Security Fix(es):</p> <p>gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.(CVE-2026-58459)</p> <p>gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredo…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP3: gpsd</p> <p>gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. Security Fix(es):</p> <p>gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.(CVE-2026-58459)</p> <p>gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredo…</p> https://cve.radiocsirt.org/vuln/oesa-2026-4222 Wed, 30 Sep 2026 13:47:45 +0000 https://cve.radiocsirt.org/vuln/oesa-2026-4221 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: gpsd</p> <p>gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. Security Fix(es):</p> <p>gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.(CVE-2026-58459)</p> <p>gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredo…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: gpsd</p> <p>gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. Security Fix(es):</p> <p>gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.(CVE-2026-58459)</p> <p>gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredo…</p> https://cve.radiocsirt.org/vuln/oesa-2026-4221 Wed, 30 Sep 2026 13:47:44 +0000