Bug#1057667: gpsd: CVE-2023-43628

2023-12-10 Thread Salvatore Bonaccorso
Hi Boian, On Sun, Dec 10, 2023 at 08:51:30AM +0100, Salvatore Bonaccorso wrote: > Hi Boian, > > On Sun, Dec 10, 2023 at 01:10:01AM +0200, Boian Bonev wrote: > > Hi, > > > > That report states that the bug affects 3.25.1~dev. There is no such gpsd > > release. > > > > I did check with upstream -

Bug#1057667: gpsd: CVE-2023-43628

2023-12-09 Thread Salvatore Bonaccorso
Hi Boian, On Sun, Dec 10, 2023 at 01:10:01AM +0200, Boian Bonev wrote: > Hi, > > That report states that the bug affects 3.25.1~dev. There is no such gpsd > release. > > I did check with upstream - that is a development git tree. And the problem is > already fixed and will not affect the next gp

Bug#1057667: gpsd: CVE-2023-43628

2023-12-09 Thread Boian Bonev
Hi, That report states that the bug affects 3.25.1~dev. There is no such gpsd release. I did check with upstream - that is a development git tree. And the problem is already fixed and will not affect the next gpsd version (supposedly 3.26) 3.25-2 in Debian is also not affected. I'd suggest clos

Bug#1057667: gpsd: CVE-2023-43628

2023-12-06 Thread Salvatore Bonaccorso
Source: gpsd Version: 3.25-2 Severity: important Tags: security upstream X-Debbugs-Cc: car...@debian.org, Debian Security Team Hi, The following vulnerability was published for gpsd. CVE-2023-43628[0]: | An integer underflow vulnerability exists in the NTRIP Stream | Parsing functionality of GP