The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2026_65162 advisory.

    * gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility (CVE-2026-60122)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-651620 advisory.

    [3.26.1-3.0.1.el10_2.2]
    - Replace upstream reference [Orabug: 37033219]

    [1:3.26.1-3.el10_2.2]
    - fix another command injection in gpsprof (CVE-2026-60122)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789389842 advisory.

  - gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the     gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by     injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a     gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the     heredoc early and append gnuplot system() calls, achieving OS command execution as the user running     gpsprof when the generated plot script is processed by gnuplot in polar mode. (CVE-2026-60122)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2026_65606 advisory.

    * gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility (CVE-2026-60122)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789034846 advisory.

  - gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the     gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by     injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a     gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the     heredoc early and append gnuplot system() calls, achieving OS command execution as the user running     gpsprof when the generated plot script is processed by gnuplot in polar mode. (CVE-2026-60122)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:65606 advisory.

    gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or     USB interface, making its data on the location/course/velocity of the sensor available to be queried on     TCP port 2947 of the host computer.  The Red Hat support for this package is limited. See     https://access.redhat.com/support/policy/gpsd-support for more details.

    Security Fix(es):

    * gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility (CVE-2026-60122)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-656060 advisory.

    [3.26.1-2.0.1.el9_8.2]
    - Replaced upstream reference [Orabug: 35865525]

    [1:3.26.1-2.el9_8.2]
    - fix another command injection in gpsprof (CVE-2026-60122)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:65606 advisory.

    * gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility (CVE-2026-60122)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the     gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by     injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a     gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the     heredoc early and append gnuplot system() calls, achieving OS command execution as the user running     gpsprof when the generated plot script is processed by gnuplot in polar mode. (CVE-2026-60122)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d39bedb422 advisory.

    Security fix for CVE-2026-60122

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1819:03 advisory.

    * gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility (CVE-2026-60122)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
356805	Rocky Linux 10.2 [CIQ] Security Update: gpsd / gpsd-clients / gpsd-clients-debuginfo / gpsd-debuginfo / etc (crlsa-2026_65162)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/2	high
343908	Oracle Linux 10 : ELSA-2026-65162-0: / gpsd (ELSA-2026-651620)	Nessus	Oracle Linux Local Security Checks	2026/9/8	2026/9/25	high
352137	AlmaLinux 9.2 [TuxCare] Security Update: gpsd-minimal / gpsd-minimal-clients (ALMALINUX9.2:CLSA-2026:1789389842)	Nessus	Alma Linux Local Security Checks	2026/9/30	2026/10/2	high
356679	Rocky Linux 9 [CIQ] Security Update: gpsd-minimal / gpsd-minimal-clients / etc (crlsa-2026_65606)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/2	high
351535	AlmaLinux 9.6 [TuxCare] Security Update: gpsd-minimal / gpsd-minimal-clients (ALMALINUX9.6:CLSA-2026:1789034846)	Nessus	Alma Linux Local Security Checks	2026/9/30	2026/10/2	high
343890	RHEL 9 : gpsd-minimal (RHSA-2026:65606)	Nessus	Red Hat Local Security Checks	2026/9/8	2026/9/25	high
344328	Oracle Linux 9 : ELSA-2026-65606-0: / gpsd-minimal (ELSA-2026-656060)	Nessus	Oracle Linux Local Security Checks	2026/9/9	2026/9/25	high
344411	RockyLinux 9 : gpsd-minimal (RLSA-2026:65606)	Nessus	Rocky Linux Local Security Checks	2026/9/9	2026/9/25	high
329614	Linux Distros Unpatched Vulnerability : CVE-2026-60122	Nessus	Misc.	2026/7/25	2026/9/14	high
376832	Fedora 45 : gpsd (2026-d39bedb422)	Nessus	Fedora Local Security Checks	2026/11/6	2026/11/6	high
345657	MiracleLinux 9 : gpsd-minimal-3.26.1-2.el9_8.2 (AXSA:2026-1819:03)	Nessus	Miracle Linux Local Security Checks	2026/9/14	2026/9/25	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high