CVE-2013-2038

Name	CVE-2013-2038
Description	The NMEA0183 driver in gpsd before 3.9 allows remote attackers to cause a denial of service (daemon termination) and possibly execute arbitrary code via a GPS packet with a malformed $GPGGA interpreted sentence that lacks certain fields and a terminator. NOTE: a separate issue in the AIS driver was also reported, but it might not be a vulnerability.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	706665

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gpsd (PTS)	buster	3.17-7	fixed
	bullseye	3.22-4	fixed
	bookworm	3.22-4.1	fixed
	trixie	3.25-2	fixed
	sid	3.25-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
gpsd	source	wheezy	3.6-4+deb7u1
gpsd	source	(unstable)	3.6-5			706665

[squeeze] - gpsd <no-dsa> (Minor issue)
http://lists.nongnu.org/archive/html/gpsd-dev/2013-05/msg00000.html