-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 25 Jul 2026 21:40:31 +0000
Source: gpsd
Binary: gpsd gpsd-clients gpsd-clients-dbgsym gpsd-dbgsym gpsd-tools gpsd-tools-dbgsym libgps-dev libgps30t64 libgps30t64-dbgsym libqgpsmm-dev libqgpsmm30t64 libqgpsmm30t64-dbgsym python3-gps python3-gps-dbgsym
Architecture: amd64
Version: 3.25-5+deb13u2
Distribution: trixie
Urgency: medium
Maintainer: amd64 / i386 Build Daemon (x86-ubc-01) <buildd_amd64-x86-ubc-01@buildd.debian.org>
Changed-By: Boian Bonev <bbonev@ipacct.com>
Description:
 gpsd       - Global Positioning System - daemon
 gpsd-clients - Global Positioning System - clients
 gpsd-tools - Global Positioning System - tools
 libgps-dev - Global Positioning System - development files
 libgps30t64 - Global Positioning System - library
 libqgpsmm-dev - Global Positioning System - Qt wrapper for libgps (development)
 libqgpsmm30t64 - Global Positioning System - Qt wrapper for libgps
 python3-gps - Global Positioning System - Python 3 libraries
Changes:
 gpsd (3.25-5+deb13u2) trixie; urgency=medium
 .
   * Fix CVE-2026-58459 (see #1141962). A command injection vulnerability
     exists in the gpsprof client. The subtype field, sourced from a
     DEVICES JSON log entry or an NMEA PGRMT sentence, is written into
     the generated gnuplot program via a set title statement with only
     double quote characters escaped. An attacker who controls the GPS
     device subtype can embed backtick payloads and execute arbitrary
     shell commands as the user running gnuplot when the generated plot
     is rendered.
   * Fix CVE-2026-60122. A code injection vulnerability exists in the
     gpsprof client. The SKY.satellites[].used field is inserted
     unsanitized into a gnuplot heredoc data block. An attacker who
     controls the GPS input data can supply a used value containing the
     string EOD to terminate the heredoc early and append gnuplot
     system() calls, achieving OS command execution as the user running
     gpsprof when the generated plot script is processed by gnuplot in
     polar mode.
Checksums-Sha1:
 70b5a7cbb323bc7aa3abd9fc5068baa81598eac2 1947936 gpsd-clients-dbgsym_3.25-5+deb13u2_amd64.deb
 860a545f679e241f50d6563f74a8e94e7c6b1e30 507444 gpsd-clients_3.25-5+deb13u2_amd64.deb
 1b06c388676b6f7aa6e2077ab90f83a8a36826ba 2296268 gpsd-dbgsym_3.25-5+deb13u2_amd64.deb
 d7261d083edf315777aa0af7dbe9d81799c64a14 1587940 gpsd-tools-dbgsym_3.25-5+deb13u2_amd64.deb
 37fb5271fcf795cbdf08fd7b4badeaff113a8c60 342472 gpsd-tools_3.25-5+deb13u2_amd64.deb
 05551a29c316b8556e535d054eeb1ca2a2a9033b 21107 gpsd_3.25-5+deb13u2_amd64-buildd.buildinfo
 8c989df7718b2eddf57329be0d5665735af8829c 422428 gpsd_3.25-5+deb13u2_amd64.deb
 fce08cae5af11e4a337fa67cd323424967adfc93 144780 libgps-dev_3.25-5+deb13u2_amd64.deb
 7e5f4864e677c62dda93602947648b9366c89e84 172076 libgps30t64-dbgsym_3.25-5+deb13u2_amd64.deb
 853f0de1057701629e39314750de7b5e2c9fc0ca 85176 libgps30t64_3.25-5+deb13u2_amd64.deb
 a2e29f64f7829e9c78d2d36101cb3adfab1bb55a 34616 libqgpsmm-dev_3.25-5+deb13u2_amd64.deb
 fd02e069e6fcae223faf9fabb1f803d9daad4260 398112 libqgpsmm30t64-dbgsym_3.25-5+deb13u2_amd64.deb
 d54e30debc5a3f298811387fbe09f5c782184165 87260 libqgpsmm30t64_3.25-5+deb13u2_amd64.deb
 39de76114c3ed9eb4a9ff45b70b40eba3eb638e7 63664 python3-gps-dbgsym_3.25-5+deb13u2_amd64.deb
 5a0380fabd9ff6af29682cb028641ce4cdf96def 152796 python3-gps_3.25-5+deb13u2_amd64.deb
Checksums-Sha256:
 8acbcb48111ebf6a2af3fe318510c397f26f8e27a7b3ca985245ce54f7237920 1947936 gpsd-clients-dbgsym_3.25-5+deb13u2_amd64.deb
 7471564ea2b843e2c08932895043226d8dbfd4c847743ecd4c5cc6d2828c79b6 507444 gpsd-clients_3.25-5+deb13u2_amd64.deb
 2f98b719dd56b841b43801f741c50810402d54ba232176bd7ad1e5312d449db6 2296268 gpsd-dbgsym_3.25-5+deb13u2_amd64.deb
 3df49a67c7e531b3cdd61308a03df32d29370c1b7f08cbf3e12e02c39c1224c9 1587940 gpsd-tools-dbgsym_3.25-5+deb13u2_amd64.deb
 08bfe644110833c202e9a3659f6ebb2ea1223074d63c8ade4b2ee4a37df4914c 342472 gpsd-tools_3.25-5+deb13u2_amd64.deb
 f8d6896be9bb2a3a3ff331ba182a53510a1bf1b789109aa50d8c159d957db50d 21107 gpsd_3.25-5+deb13u2_amd64-buildd.buildinfo
 1e2de8f5159cf0fcf147cd08f1eefa8ee2fb03e01a836388fd50b6f6339800ba 422428 gpsd_3.25-5+deb13u2_amd64.deb
 3475b167376602bc1f0b466b5c5962bfa3238a3a965651bf60bb63d4fe354361 144780 libgps-dev_3.25-5+deb13u2_amd64.deb
 1bb41ec6c3042b49f0cf569530087e9b8bb34175a57eb91b80f8fee9a762d480 172076 libgps30t64-dbgsym_3.25-5+deb13u2_amd64.deb
 77a7c64b3c4d6a63ea9104931cf5f88b2df7491171860a17bc50a403ec9ebb31 85176 libgps30t64_3.25-5+deb13u2_amd64.deb
 e6b176c653f254ede677197adaa758c23e7fbf784623b1c29404776f464ca4ac 34616 libqgpsmm-dev_3.25-5+deb13u2_amd64.deb
 944ada2b0b9108f5e855c2a146c3c958124e9aed7124fc3d2289d689b4589b0d 398112 libqgpsmm30t64-dbgsym_3.25-5+deb13u2_amd64.deb
 249fb9b2525e968e8b3db7aa9630b893b481cef67c2c1f75f245c93020e74f57 87260 libqgpsmm30t64_3.25-5+deb13u2_amd64.deb
 6fb2fa0093304200968115023d80c7f70a07effc36533ccda95e74bd5cec667c 63664 python3-gps-dbgsym_3.25-5+deb13u2_amd64.deb
 f7a0e7e1a9444f05046d8fe926d3d15dfe8c11cf44bb0a26c377a5491997a08b 152796 python3-gps_3.25-5+deb13u2_amd64.deb
Files:
 61383c36af9aba29c84f16872803e177 1947936 debug optional gpsd-clients-dbgsym_3.25-5+deb13u2_amd64.deb
 e3732d694bf6b98ffbbc47347b369602 507444 misc optional gpsd-clients_3.25-5+deb13u2_amd64.deb
 647b0e11128172a6f1bb9c933291937e 2296268 debug optional gpsd-dbgsym_3.25-5+deb13u2_amd64.deb
 eb2a1e1b15d7739e751be5129bb51f49 1587940 debug optional gpsd-tools-dbgsym_3.25-5+deb13u2_amd64.deb
 4c066375d866dc77d757b7575a947abd 342472 misc optional gpsd-tools_3.25-5+deb13u2_amd64.deb
 223486b0fff93a8c8fbbad21af02938d 21107 misc optional gpsd_3.25-5+deb13u2_amd64-buildd.buildinfo
 5f1ac564fb7ac9152aebf07cfdfc4e82 422428 misc optional gpsd_3.25-5+deb13u2_amd64.deb
 74bbb2006d3a81b8c82f4057f522baa4 144780 libdevel optional libgps-dev_3.25-5+deb13u2_amd64.deb
 a5433f0f63eb56d8c233320e5a7c69cb 172076 debug optional libgps30t64-dbgsym_3.25-5+deb13u2_amd64.deb
 e346a0a7cc6976a9c5aaf8cf9ec7d39f 85176 libs optional libgps30t64_3.25-5+deb13u2_amd64.deb
 1f1390baa22179c65c107ddd71382c9e 34616 libdevel optional libqgpsmm-dev_3.25-5+deb13u2_amd64.deb
 35ef77c9e15e0c9862992ae0182bf384 398112 debug optional libqgpsmm30t64-dbgsym_3.25-5+deb13u2_amd64.deb
 54c680486ebcaa5d014f44406aa8d060 87260 libs optional libqgpsmm30t64_3.25-5+deb13u2_amd64.deb
 fbb452e542bc4c60eb67afb27cda4ac3 63664 debug optional python3-gps-dbgsym_3.25-5+deb13u2_amd64.deb
 290b14f9cc5b94d17153905506945c01 152796 python optional python3-gps_3.25-5+deb13u2_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEmtr4KUMaso2EQ6NrTwt/65ON6zcFAmpmL2IACgkQTwt/65ON
6zdwsg/+Ks9Kx6SmBBCEZ++MmM7O/IQ49nd6Idz/uVCZg+YVKwsCq4uEQ7+HSNbw
FxDH4fsgs9SX8+OexZr9CHynT7s7oFQIdnu3M+P50vDxqIYdjf+Gujy1D/6zpgXn
mSrBXiSZc6YomsqdyFPkdBW2qEEElMMSPTc+skZhEG1QM4sox881vv7AYa6YhSwJ
ssfbZAeJmtRDr8AAWn8PaPyDgJ6lUzDmkYdm5e2oXkk3pacAOcVKiASd5W7SohSZ
oXwWPjsvuB/+KPUB5gCpNOj6y0yYvaeTq/ARbeNO4fHBnOtqvPAmXLCjJ4qDs1Zj
+tJpGM2D/ZSzzRRTWEbTCMFQmof0SVFQepKEsnQIZ5pgOu5/YYQdin89N6oJdRoD
nvl8+9XLZfazI4gnb3D8PTqMs/tVxdsNx7Qp1+1ky3XbUoVHTYH2e0+i79Saw0FC
yeVzu9tlSWgP1juGZCYJjRDpacdviTdrQB6y6zrzJR+BymwIsUI5CIupCrTskeMq
sWSAd6rlCVS2DXsx9Q6uwD9xI00DpSLCWZB97JE5RgkVkL1t6fKYhGW39HqfEIso
MoW/LelH5kwfZU8HZen0hiS2fze1zvRtLKVIJFI8PMBXiYPAZmWXUAoCvSvTdCAc
dDhUJlkNXLZ78yWIQzOjOxwQVUzORtP2fkmUIOW5GBVYVCIa9Do=
=/O/g
-----END PGP SIGNATURE-----