Fixes a build error when pod2man is missing on the host:
pod2man ./tools/lsmac.pl >lsmac.1 || { rm -f lsmac.1 ; false ; }
/bin/sh: line 1: pod2man: command not found
Fixes:
https://autobuild.buildroot.net/results/999/9996e81429f90f4615755827ac182094d416c467/
Although the build error only occurs since 2026-03-05 it should be
backported to LTS branches because the last change to the buildroot
package dates back to 2024.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ec62109990)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Buildroot commit 0645cb39e0 bumped the
package from 1.7 to 1.8.1.
Upstream included commit
f614f35e73
in version 1.8 to switch from pcre to pcre2 but the buildroot package
was not updated accordingly.
Pcre2 was already selected by pango -> libglib2 -> pcre2 so this bug was
never noticed.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e8466476c4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Buildroot commit 00317f0aff switched the
package from pcre to pcre2 but forgot update the Kconfig help text.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 60a95e04d4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
See the release notes of intermediate versions:
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.28.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.29.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.30.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.30.1
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.30.2
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.31.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.32.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.33.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.33.1
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.34.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.35.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.36.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.1
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.2
This fixes numerous vulnerabilities:
- CVE-2026-21428:
cpp-httplib is a C++11 single-file header-only cross platform
HTTP/HTTPS library. Prior to version 0.30.0, the ``write_headers``
function does not check for CR & LF characters in user supplied
headers, allowing untrusted header value to escape header lines. This
vulnerability allows attackers to add extra headers, modify request
body unexpectedly & trigger an SSRF attack. When combined with a
server that supports http1.1 pipelining (springboot, python twisted
etc), this can be used for server side request forgery (SSRF). Version
0.30.0 fixes this issue.
https://www.cve.org/CVERecord?id=CVE-2026-21428
- CVE-2026-22776:
cpp-httplib is a C++11 single-file header-only cross platform
HTTP/HTTPS library. Prior to version 0.30.1, a Denial of Service (DoS)
vulnerability exists in cpp-httplib due to the unsafe handling of
compressed HTTP request bodies (Content-Encoding: gzip, br, etc.). The
library validates the payload_max_length against the compressed data
size received from the network, but does not limit the size of the
decompressed data stored in memory.
https://www.cve.org/CVERecord?id=CVE-2026-22776
- CVE-2026-28434:
cpp-httplib is a C++11 single-file header-only cross platform
HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a
C++ exception and the application has not registered a custom
exception handler via set_exception_handler(), the library catches the
exception and writes its message directly into the HTTP response as a
header named EXCEPTION_WHAT. This header is sent to whoever made the
request, with no authentication check and no special configuration
required to trigger it. The behavior is on by default. A developer who
does not know to opt in to set_exception_handler() will ship a server
that leaks internal exception messages to any client. This
vulnerability is fixed in 0.35.0.
https://www.cve.org/CVERecord?id=CVE-2026-28434
- CVE-2026-28435:
cpp-httplib is a C++11 single-file header-only cross platform
HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not
enforce Server::set_payload_max_length() on the decompressed request
body when using HandlerWithContentReader (streaming ContentReader)
with Content-Encoding: gzip (or other supported encodings). A small
compressed payload can expand beyond the configured payload limit and
be processed by the application, enabling a payload size limit bypass
and potential denial of service (CPU/memory exhaustion). This
vulnerability is fixed in 0.35.0.
https://www.cve.org/CVERecord?id=CVE-2026-28435
- CVE-2026-29076:
cpp-httplib is a C++11 single-file header-only cross platform
HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses
std::regex (libstdc++) to parse RFC 5987 encoded filename* values in
multipart Content-Disposition headers. The regex engine in libstdc++
implements backtracking via deep recursion, consuming one stack frame
per input character. An attacker can send a single HTTP POST request
with a crafted filename* parameter that causes uncontrolled stack
growth, resulting in a stack overflow (SIGSEGV) that crashes the
server process. This issue has been patched in version 0.37.0.
https://www.cve.org/CVERecord?id=CVE-2026-29076
- CVE-2026-31870:
cpp-httplib is a C++11 single-file header-only cross platform
HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib client uses
the streaming API (httplib::stream::Get, httplib::stream::Post, etc.),
the library calls std::stoull() directly on the Content-Length header
value received from the server with no input validation and no
exception handling. std::stoull throws std::invalid_argument for non-
numeric strings and std::out_of_range for values exceeding ULLONG_MAX.
Since nothing catches these exceptions, the C++ runtime calls
std::terminate(), which kills the process with SIGABRT. Any server the
client connects to — including servers reached via HTTP redirects,
third-party APIs, or man-in-the-middle positions can crash the client
application with a single HTTP response. No authentication is
required. No interaction from the end user is required. The crash is
deterministic and immediate. This vulnerability is fixed in 0.37.1.
https://www.cve.org/CVERecord?id=CVE-2026-31870
- CVE-2026-32627:
cpp-httplib is a C++11 single-file header-only cross platform
HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is
configured with a proxy and set_follow_location(true), any HTTPS
redirect it follows will have TLS certificate and hostname
verification silently disabled on the new connection. The client will
accept any certificate presented by the redirect target — expired,
self-signed, or forged — without raising an error or notifying the
application. A network attacker in a position to return a redirect
response can fully intercept the follow-up HTTPS connection, including
any credentials or session tokens in flight. This vulnerability is
fixed in 0.37.2.
https://www.cve.org/CVERecord?id=CVE-2026-32627
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8dad17ea06)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Require host-pkgconf only for libtirpc is not enough because libmnl
requires as well.
Upstream added it since 20200515 commit
553ca8ea3b ("net/route: Add netlink based route change tests")
using it in m4/ltp-libmnl.m4.
Later, in 20210524 in commit
6e17e2ba13 ("configure: Improve error message on missing pkg-config")
configure.ac required it explicitly:
m4_ifndef([PKG_CHECK_EXISTS],
[m4_fatal([must install pkg-config or pkgconfig and pkg.m4 macro (usual dependency), see INSTALL])])
This fixes error:
checking pkg-config is at least version 0.9.0... ./configure: line 7419: br-mips64r6-el-hf-glibc/host/bin/pkg-config: No such file or directory
Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d421a5d278)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Buildroot commit c9f7b876ee added a patch to
fix the vulnerability for rauc v1.13, but forgot to ignore the CVE in rauc.mk
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes the following vulnerability:
- CVE-2026-27135:
nghttp2 is an implementation of the Hypertext Transfer Protocol
version 2 in C. Prior to version 1.68.1, the nghttp2 library stops
reading the incoming data when user facing public API
`nghttp2_session_terminate_session` or
`nghttp2_session_terminate_session2` is called by the application.
They might be called internally by the library when it detects the
situation that is subject to connection error. Due to the missing
internal state validation, the library keeps reading the rest of the
data after one of those APIs is called. Then receiving a malformed
frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2
v1.68.1 adds missing state validation to avoid assertion failure. No
known workarounds are available.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-27135
- 5c7df8fa81
(cherry picked from commit 7d26ff6c14)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
As of glibc 2.43, faketime build was broken in buildroot because of a
missing const qualifier. A patch was applied to it in master to fix this
issue.
Sadly, due to a difference in faketime version between master (v0.9.12) and
2025.02.x (v0.9.10), the patch didn't apply properly in 2025.02.x.
Rebase the faketime patch on v0.9.10.
Fixes:
https://autobuild.buildroot.org/results/761/761250e8cbb2602abdc7752d182a44b6f7de5e11
Signed-off-by: Thomas Bonnefille <thomas.bonnefille@bootlin.com>
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Add a basic runtime test for memcached. The test starts memcached and
checks if it responds to a basic set/get request.
Signed-off-by: Franciszek Stachura <fbstachura@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit aa2d71ac38)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This fixes the following vulnerability:
RAUC bundles using the 'plain' format exceeding a payload size of 2 GiB
cause an integer overflow which results in a signature which covers only
the first few bytes of the payload. Given such a bundle with a legitimate
signature, an attacker can modify the part of the payload which is not
covered by the signature. Bundles using the recommended 'verity' or
'crypt' formats are not affected. They are supported from v1.5
(released 2020-12-14) and v1.7 (released 2022-06-03) respectively.
If all signed and published bundles were smaller than 2GiB,
the vulnerability cannot be exploited.
https://github.com/rauc/rauc/security/advisories/GHSA-6hj7-q844-m2hx
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit 6e4a136363)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
See the release notes:
https://docs.djangoproject.com/en/5.2/releases/5.2.12/
This fixes the following vulnerabilities:
- CVE-2026-25673:
An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and
4.2 before 4.2.29. `URLField.to_python()` in Django calls
`urllib.parse.urlsplit()`, which performs NFKC normalization on
Windows that is disproportionately slow for certain Unicode
characters, allowing a remote attacker to cause denial of service via
large URL inputs containing these characters. Earlier, unsupported
Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and
may also be affected. Django would like to thank Seokchan Yoon for
reporting this issue.
https://www.cve.org/CVERecord?id=CVE-2026-25673
- CVE-2026-25674:
An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and
4.2 before 4.2.29. Race condition in file-system storage and file-
based cache backends in Django allows an attacker to cause file system
objects to be created with incorrect permissions via concurrent
requests, where one thread's temporary `umask` change affects other
threads in multi-threaded environments. Earlier, unsupported Django
series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may
also be affected. Django would like to thank Tarek Nakkouch for
reporting this issue.
https://www.cve.org/CVERecord?id=CVE-2026-25674
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit c8dd9e9a01)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Read the announcements:
- https://www.ruby-lang.org/en/news/2025/10/07/ruby-3-4-7-released/
- https://www.ruby-lang.org/en/news/2025/12/17/ruby-3-4-8-released/
- https://www.ruby-lang.org/en/news/2026/03/11/ruby-3-4-9-released/
This fixes a few vulnerabilities in bundled gems (ruby libraires):
- CVE-2025-27221:
In the URI gem before 1.0.3 for Ruby, the URI handling methods
(URI.join, URI#merge, URI#+) have an inadvertent leakage of
authentication credentials because userinfo is retained even after
changing the host.
https://www.cve.org/CVERecord?id=CVE-2025-27221
- CVE-2025-58767:
REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1
has a DoS vulnerability when parsing XML containing multiple XML
declarations. If you need to parse untrusted XMLs, you may be impacted
to these vulnerabilities. The REXML gem 3.4.2 or later include the
patches to fix these vulnerabilities.
https://www.cve.org/CVERecord?id=CVE-2025-58767
- CVE-2025-61594:
URI is a module providing classes to handle Uniform Resource
Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass
exists for the fix to CVE-2025-27221 that can expose user credentials.
When using the `+` operator to combine URIs, sensitive information
like passwords from the original URI can be leaked, violating RFC3986
and making applications vulnerable to credential exposure. Versions
0.12.5, 0.13.3, and 1.0.4 fix the issue.
https://www.cve.org/CVERecord?id=CVE-2025-61594
- CVE-2026-27820:
The zstream_buffer_ungets function prepends caller-provided bytes
ahead of previously produced output but fails to guarantee the backing
Ruby string has enough capacity before the memmove shifts the existing
data. This can lead to memory corruption when the buffer length exceeds
capacity.
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Config.in selects libiconv in certain situations (uClibc with locales
not enabled). This may lead to a build error with utils/test-pkg -p mpd.
Add missing optional dependency and restore sorting order.
Signed-off-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 83e637d7cc)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The documentation feature was introduced with version 0.22, but is not
used. Instead two other options (also introduced with 0.22) control
building HTML manual and man pages. If the tools needed are not found,
the documentation build finishes silently.
Save Meson some effort by setting both options to 'false'.
Signed-off-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e7e2050d54)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Add 'source' attribute to each CVE in vulnerabilities node, including NVD
URL reference to enable proper import into Dependency-Track.
Dependency-Track's VEX importer requires the source attribute to
properly process vulnerability entries. Without it, vulnerabilities are
skipped during import with "does not have an ID and / or source" warnings.
Include the full NVD URL following the CycloneDX 1.6 documentation format:
https://nvd.nist.gov/vuln/detail/{CVE-ID}
Test Environment:
- Buildroot: 2025.02.11 (or master)
- Dependency-Track: v4.13.6
Test Results - BEFORE (without source attribute):
apiserver_1 | 2026-02-23 16:05:40,890 INFO [VexUploadProcessingTask] Processing CycloneDX VEX uploaded to project: e43fe185-c0a3-4e3a-a908-667344a66a9c
apiserver_1 | 2026-02-23 16:05:40,941 WARN [CycloneDXVexImporter] VEX vulnerability at position #0 does not have an ID and / or source; Skipping it
apiserver_1 | 2026-02-23 16:05:40,941 WARN [CycloneDXVexImporter] VEX vulnerability at position #1 does not have an ID and / or source; Skipping it
...
apiserver_1 | 2026-02-23 16:05:40,941 WARN [CycloneDXVexImporter] VEX vulnerability at position #19 does not have an ID and / or source; Skipping it
apiserver_1 | 2026-02-23 16:05:40,941 INFO [CycloneDXVexImporter] The uploaded VEX does not contain any applicable vulnerabilities; Skipping VEX import
Test Results - AFTER (with source):
apiserver_1 | 2026-02-23 16:17:13,492 INFO [VexUploadProcessingTask] Processing CycloneDX VEX uploaded to project: e43fe185-c0a3-4e3a-a908-667344a66a9c
apiserver_1 | 2026-02-23 16:17:14,054 INFO [VexUploadProcessingTask] Completed processing of CycloneDX VEX for project: e43fe185-c0a3-4e3a-a908-667344a66a9c
CVEs are correctly imported in Dependency-Track
Signed-off-by: Fabien Lehoussel <fabien.lehoussel@smile.fr>
Acked-By: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 3a5e70d1d1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Following changes made it into the release:
Joris van Rantwijk (1):
Fix adjtimex() with TIME64
Waldemar Brodkorb (8):
sys/stat.h: remove _STAT_VER/_MKNOD_VER
fix gettid() declaration
add statx syscall wrapper
sparc: add optimize build support for leon3
sparc: sync with Linux kernel definition, fixes gdb compile
fix compile error on earlier Kernels predating statx
select: fix compilation failure with very old kernel
bump version for 1.0.57 release
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 84bc50c82d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
uclibc 1.0.57 added a statx() syscall wrapper in upstream commit [1].
zfs fail to build with uclibc 1.0.57 (not yet in Buildroot), because:
1. uclibc <fcntl.h> internally includes <sys/stat.h>, and
2. a zfs test redefines a statx() wrapper with a slightly different
prototype.
In that case, zfs fails to compile with error:
tests/zfs-tests/cmd/statx.c:58:1: error: conflicting types for 'statx'; have 'int(int, const char *, int, unsigned int, void *)'
Issue has been reported upstream at [2].
This commit adds a package patch to fix that issue.
[1] d3a819aff2
[2] https://github.com/openzfs/zfs/pull/18316
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b6884913ae)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes the following vulnerability:
- CVE-2026-24049:
wheel is a command line tool for manipulating Python wheel files, as
defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack
function is vulnerable to file permission modification through
mishandling of file permissions after extraction. The logic blindly
trusts the filename from the archive header for the chmod operation,
even though the extraction process itself might have sanitized the
path. Attackers can craft a malicious wheel file that, when unpacked,
changes the permissions of critical system files (e.g., /etc/passwd,
SSH keys, config files), allowing for Privilege Escalation or
arbitrary code execution by modifying now-writable scripts. This issue
has been fixed in version 0.46.2.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-24049
- https://github.com/advisories/GHSA-8rrh-rw8j-w5fx
(cherry picked from commit 635c145c16)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes the following vulnerabilities:
- CVE-2025-67724:
Tornado is a Python web framework and asynchronous networking library.
In versions 6.5.2 and below, the supplied reason phrase is used
unescaped in HTTP headers (where it could be used for header
injection) or in HTML in the default error page (where it could be
used for XSS) and can be exploited by passing untrusted or malicious
data into the reason argument. Used by both RequestHandler.set_status
and tornado.web.HTTPError, the argument is designed to allow
applications to pass custom "reason" phrases (the "Not Found" in
HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-
standard status codes). This issue is fixed in version 6.5.3.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-67724
- 9c163aebea
- CVE-2025-67725:
Tornado is a Python web framework and asynchronous networking library.
In versions 6.5.2 and below, a single maliciously crafted HTTP request
can block the server's event loop for an extended period, caused by
the HTTPHeaders.add method. The function accumulates values using
string concatenation when the same header name is repeated, causing a
Denial of Service (DoS). Due to Python string immutability, each
concatenation copies the entire string, resulting in O(n²) time
complexity. The severity can vary from high if max_header_size has
been increased from its default, to low if it has its default value of
64KB. This issue is fixed in version 6.5.3.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-67725
- 771472cfda
- CVE-2025-67726:
Tornado is a Python web framework and asynchronous networking library.
Versions 6.5.2 and below use an inefficient algorithm when parsing
parameters for HTTP header values, potentially causing a DoS. The
_parseparam function in httputil.py is used to parse specific HTTP
header values, such as those in multipart/form-data and repeatedly
calls string.count() within a nested loop while processing quoted
semicolons. If an attacker sends a request with a large number of
maliciously crafted parameters in a Content-Disposition header, the
server's CPU usage increases quadratically (O(n²)) during parsing. Due
to Tornado's single event loop architecture, a single malicious
request can cause the entire server to become unresponsive for an
extended period. This issue is fixed in version 6.5.3.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-67726
- 771472cfda
(cherry picked from commit e59cc42d2f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2025-68431:
libheif is an HEIF and AVIF file format decoder and encoder. Prior to
version 1.21.0, a crafted HEIF that exercises the overlay image item
path triggers a heap buffer over-read in `HeifPixelImage::overlay()`.
The function computes a negative row length (likely from an unclipped
overlay rectangle or invalid offsets), which then underflows when
converted to `size_t` and is passed to `memcpy`, causing a very large
read past the end of the source plane and a crash. Version 1.21.0
contains a patch. As a workaround, avoid decoding images using `iovl`
overlay boxes.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-68431
- b8c12a7b70
(cherry picked from commit a8aed698c7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2025-65502:
Null pointer dereference in add_ca_certs() in Cesanta Mongoose before
7.2 allows remote attackers to cause a denial of service via TLS
initialization where SSL_CTX_get_cert_store() returns NULL.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-65502
- 64abf061bf
(cherry picked from commit f536fd4a2e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The `0002-gpsd-packet.c-Fix-integer-underflow-is-malicious-Nav.patch`
patch remove a hunk added in [1], not present in version 3.25. present
in 2025.02.x.
Fixes the following vulnerabilities:
- CVE-2025-67268:
gpsd before commit dc966aa contains a heap-based out-of-bounds write
vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540
function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View)
packets, fails to validate the user-supplied satellite count against
the size of the skyview array (184 elements). This allows an attacker
to write beyond the bounds of the array by providing a satellite count
up to 255, leading to memory corruption, Denial of Service (DoS), and
potentially arbitrary code execution.
For more information, see:
- dc966aa74c
- https://www.cve.org/CVERecord?id=CVE-2025-67268
- CVE-2025-67269:
An integer underflow vulnerability exists in the `nextstate()`
function in `gpsd/packet.c` of gpsd versions prior to commit
`ffa1d6f40bca0b035fc7f5e563160ebb67199da7`. When parsing a NAVCOM
packet, the payload length is calculated using `lexer->length =
(size_t)c - 4` without checking if the input byte `c` is less than 4.
This results in an unsigned integer underflow, setting `lexer->length`
to a very large value (near `SIZE_MAX`). The parser then enters a loop
attempting to consume this massive number of bytes, causing 100% CPU
utilization and a Denial of Service (DoS) condition.
For more information, see:
- ffa1d6f40b
- https://www.cve.org/CVERecord?id=CVE-2025-67269
[1] 247a89136c
(cherry picked from commit d41ed2ea54)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
