An update for gpsd is now available for openEuler-24.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4220 Final 1.0 1.0 2026-09-30 Initial 2026-09-30 2026-09-30 openEuler SA Tool V1.0 2026-09-30 gpsd security update An update for gpsd is now available for openEuler-24.03-LTS-SP4 gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. Security Fix(es): gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.(CVE-2026-58459) gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.(CVE-2026-60122) An update for gpsd is now available for openEuler-24.03-LTS-SP4. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical gpsd https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4220 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-58459 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-60122 https://nvd.nist.gov/vuln/detail/CVE-2026-58459 https://nvd.nist.gov/vuln/detail/CVE-2026-60122 openEuler-24.03-LTS-SP4 gpsd-3.25-6.oe2403sp4.src.rpm gpsd-3.25-6.oe2403sp4.x86_64.rpm gpsd-clients-3.25-6.oe2403sp4.x86_64.rpm gpsd-debuginfo-3.25-6.oe2403sp4.x86_64.rpm gpsd-debugsource-3.25-6.oe2403sp4.x86_64.rpm gpsd-devel-3.25-6.oe2403sp4.x86_64.rpm gpsd-libs-3.25-6.oe2403sp4.x86_64.rpm gpsd-qt-3.25-6.oe2403sp4.x86_64.rpm gpsd-qt-devel-3.25-6.oe2403sp4.x86_64.rpm gpsd-xclients-3.25-6.oe2403sp4.x86_64.rpm python3-gpsd-3.25-6.oe2403sp4.x86_64.rpm gpsd-3.25-6.oe2403sp4.aarch64.rpm gpsd-clients-3.25-6.oe2403sp4.aarch64.rpm gpsd-debuginfo-3.25-6.oe2403sp4.aarch64.rpm gpsd-debugsource-3.25-6.oe2403sp4.aarch64.rpm gpsd-devel-3.25-6.oe2403sp4.aarch64.rpm gpsd-libs-3.25-6.oe2403sp4.aarch64.rpm gpsd-qt-3.25-6.oe2403sp4.aarch64.rpm gpsd-qt-devel-3.25-6.oe2403sp4.aarch64.rpm gpsd-xclients-3.25-6.oe2403sp4.aarch64.rpm python3-gpsd-3.25-6.oe2403sp4.aarch64.rpm gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow. 2026-09-30 CVE-2026-58459 openEuler-24.03-LTS-SP4 Critical 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H gpsd security update 2026-09-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4220 gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode. 2026-09-30 CVE-2026-60122 openEuler-24.03-LTS-SP4 High 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H gpsd security update 2026-09-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4220