-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 25 Jul 2026 21:40:31 +0000
Source: gpsd
Binary: gpsd gpsd-clients gpsd-clients-dbgsym gpsd-dbgsym gpsd-tools gpsd-tools-dbgsym libgps-dev libgps30t64 libgps30t64-dbgsym libqgpsmm-dev libqgpsmm30t64 libqgpsmm30t64-dbgsym python3-gps python3-gps-dbgsym
Architecture: arm64
Version: 3.25-5+deb13u2
Distribution: trixie
Urgency: medium
Maintainer: arm64 Build Daemon (arm-conova-04) <buildd_arm64-arm-conova-04@buildd.debian.org>
Changed-By: Boian Bonev <bbonev@ipacct.com>
Description:
 gpsd       - Global Positioning System - daemon
 gpsd-clients - Global Positioning System - clients
 gpsd-tools - Global Positioning System - tools
 libgps-dev - Global Positioning System - development files
 libgps30t64 - Global Positioning System - library
 libqgpsmm-dev - Global Positioning System - Qt wrapper for libgps (development)
 libqgpsmm30t64 - Global Positioning System - Qt wrapper for libgps
 python3-gps - Global Positioning System - Python 3 libraries
Changes:
 gpsd (3.25-5+deb13u2) trixie; urgency=medium
 .
   * Fix CVE-2026-58459 (see #1141962). A command injection vulnerability
     exists in the gpsprof client. The subtype field, sourced from a
     DEVICES JSON log entry or an NMEA PGRMT sentence, is written into
     the generated gnuplot program via a set title statement with only
     double quote characters escaped. An attacker who controls the GPS
     device subtype can embed backtick payloads and execute arbitrary
     shell commands as the user running gnuplot when the generated plot
     is rendered.
   * Fix CVE-2026-60122. A code injection vulnerability exists in the
     gpsprof client. The SKY.satellites[].used field is inserted
     unsanitized into a gnuplot heredoc data block. An attacker who
     controls the GPS input data can supply a used value containing the
     string EOD to terminate the heredoc early and append gnuplot
     system() calls, achieving OS command execution as the user running
     gpsprof when the generated plot script is processed by gnuplot in
     polar mode.
Checksums-Sha1:
 6268b855908bcae3bd0fd46a7b46e0d6b8624d79 1945028 gpsd-clients-dbgsym_3.25-5+deb13u2_arm64.deb
 22977322ed30b97b5ecc1f838c3fb719d40b2639 488480 gpsd-clients_3.25-5+deb13u2_arm64.deb
 5bec3dfe5c0fe8c07eedf6735ed57ae51a69b25c 2283256 gpsd-dbgsym_3.25-5+deb13u2_arm64.deb
 f25b1410cf16cd442a16f97f084601f2ac945054 1576504 gpsd-tools-dbgsym_3.25-5+deb13u2_arm64.deb
 3886c8aa13d546b70c99a8d8f8fde9dbed434750 330844 gpsd-tools_3.25-5+deb13u2_arm64.deb
 6f8f0aa04a0d549e026c07015f1b31a84eed9b9c 21040 gpsd_3.25-5+deb13u2_arm64-buildd.buildinfo
 3dbd9c9584e9a8517bf2122f42eb5e23132fb721 406372 gpsd_3.25-5+deb13u2_arm64.deb
 f250b2c6b2c06086a5a8e69f4d03ba3a9c868de1 148016 libgps-dev_3.25-5+deb13u2_arm64.deb
 d5cc24422646b7743af6ddb593c7b035a74789f6 170844 libgps30t64-dbgsym_3.25-5+deb13u2_arm64.deb
 03f1a2addb06a5a122bc2ac337ca5019e86f3cf3 87976 libgps30t64_3.25-5+deb13u2_arm64.deb
 7c842bf3793c819853c712ac7c4f39b0ab21e9cf 34600 libqgpsmm-dev_3.25-5+deb13u2_arm64.deb
 1abea20e8bb02c26af4e3e4349b8d919c3edcd3e 396796 libqgpsmm30t64-dbgsym_3.25-5+deb13u2_arm64.deb
 74740c1f0757a53bf3ff880be194d7091f6a2476 89868 libqgpsmm30t64_3.25-5+deb13u2_arm64.deb
 c73d4c87ba4eebdf376e9a2c31607eb06b925e79 62204 python3-gps-dbgsym_3.25-5+deb13u2_arm64.deb
 664c44110e4908955b2a1e8da2ca5d599eb7a008 151840 python3-gps_3.25-5+deb13u2_arm64.deb
Checksums-Sha256:
 3fb07b917115eb800b39a3ec37c356f57dc357971afb67e9642800313df41d33 1945028 gpsd-clients-dbgsym_3.25-5+deb13u2_arm64.deb
 c760773d5cfa3b0e44b9631a781cc363257647019afe79a57a3dd60ebd83cee1 488480 gpsd-clients_3.25-5+deb13u2_arm64.deb
 4cffe75481543f177c9a1f06d610140e5fa352bd533b65f2da8bc870dcb85eb1 2283256 gpsd-dbgsym_3.25-5+deb13u2_arm64.deb
 cac4c20ba3c1de1e4260f79879d6717985a62a6142aa1b636c7aba7fcdeaec00 1576504 gpsd-tools-dbgsym_3.25-5+deb13u2_arm64.deb
 a280be0e8ddeee09e83f41db7313e88da2b68d981edf1c6fcea44edf9594cd49 330844 gpsd-tools_3.25-5+deb13u2_arm64.deb
 49e3e6b1301aa017d5dacec69fed58e1a91622721ec744151311a867f9ec9c10 21040 gpsd_3.25-5+deb13u2_arm64-buildd.buildinfo
 a28dcf7ef176c116841f4d9ea13670c65b3cca539cfb3ec8c87c52966d0ac983 406372 gpsd_3.25-5+deb13u2_arm64.deb
 8366e479ed065b82638af5dc864a0ecf697ee7337b3c992872a296735987d661 148016 libgps-dev_3.25-5+deb13u2_arm64.deb
 7dcb248d11b2cd2f473e62a6cd662fdc5f5dd7bcbd52096e24714a1f7d474136 170844 libgps30t64-dbgsym_3.25-5+deb13u2_arm64.deb
 3e1a43ec38cd91d24ec866527f81ea64a1eada04dee55ba5c12933eeb9b2c93d 87976 libgps30t64_3.25-5+deb13u2_arm64.deb
 2fa99d52870186ce7cf70c7a75b43df5de1e24a978b1c5dea539f8b4670e4980 34600 libqgpsmm-dev_3.25-5+deb13u2_arm64.deb
 62aa6379ac26bb493d241adad6aec8baeb6a37157140b91892cbe695d2dccbfe 396796 libqgpsmm30t64-dbgsym_3.25-5+deb13u2_arm64.deb
 5292d5f0f1227bd6fbe4009fb7f68fea7d879ec489c6847ffced52b09452417b 89868 libqgpsmm30t64_3.25-5+deb13u2_arm64.deb
 136e4f4bcc52045eed4f818dcc18c267ab2c9809e2952e91d5e54970b4a84f95 62204 python3-gps-dbgsym_3.25-5+deb13u2_arm64.deb
 5f1500f4cc5b6554435634482eea3f34c0545e5582ee2ee9906513c9038e1a66 151840 python3-gps_3.25-5+deb13u2_arm64.deb
Files:
 1be4d33565729af70d7cd0b459ceab13 1945028 debug optional gpsd-clients-dbgsym_3.25-5+deb13u2_arm64.deb
 721656849dec8f56ed014bebb2c49d9b 488480 misc optional gpsd-clients_3.25-5+deb13u2_arm64.deb
 328a305d79e10b6f88f45e692c25cc44 2283256 debug optional gpsd-dbgsym_3.25-5+deb13u2_arm64.deb
 57db8bf9ace1b17f06dff35ac5915b9e 1576504 debug optional gpsd-tools-dbgsym_3.25-5+deb13u2_arm64.deb
 cccef268ec0fd33f76e3500d2ed7054d 330844 misc optional gpsd-tools_3.25-5+deb13u2_arm64.deb
 164441a2ce8072d578a5583578b34ab2 21040 misc optional gpsd_3.25-5+deb13u2_arm64-buildd.buildinfo
 37f1a18d7a193e96d49a3eff96da9887 406372 misc optional gpsd_3.25-5+deb13u2_arm64.deb
 fe02b2e9ecadfb9f8b24421ca2925b30 148016 libdevel optional libgps-dev_3.25-5+deb13u2_arm64.deb
 1142a74c8eb48c3c49b50561831a2754 170844 debug optional libgps30t64-dbgsym_3.25-5+deb13u2_arm64.deb
 c948dbf4647ef20a61ce3950176a14aa 87976 libs optional libgps30t64_3.25-5+deb13u2_arm64.deb
 6c4841a2efc1a8822e0e5de55cd37e74 34600 libdevel optional libqgpsmm-dev_3.25-5+deb13u2_arm64.deb
 7862ad09a25dfc0121e4b277f6f215fd 396796 debug optional libqgpsmm30t64-dbgsym_3.25-5+deb13u2_arm64.deb
 ab49273a5f61dbe25da5a5aa1832a780 89868 libs optional libqgpsmm30t64_3.25-5+deb13u2_arm64.deb
 0d5c2a9fb7f64583e3f71eeb04f5dca4 62204 debug optional python3-gps-dbgsym_3.25-5+deb13u2_arm64.deb
 dc4e72746773832c2f86f14d4d42de70 151840 python optional python3-gps_3.25-5+deb13u2_arm64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEYxmcRLDHP0tCCM0oScpU3dYulLgFAmpmL5MACgkQScpU3dYu
lLhx9xAAg88yFsIPNv83VBQlqk4kNPkouMWVrjRLa7xpN8AHIWNkPdubqYhspmy1
cGEC8GEeA5pP2820Qyingn7SKZ7v2mHfrP25fMtltWZCP0+yYEW/jlgxwEMTupix
/pm4cFPU3N3N0GLxz3V/IrwNPvxJQgc6LTcXaL0uGVo5A9tP+DEW9Nr80EPWm9gq
tYGZH37H4y+DxKfgKoaEJbb5ChgO984CQOtHMkKGRkMerpYVOHWDvrOf8L7zhYkN
/UqYprONBYYgcEvlYo/5bfkbkiuoGhPilaeTeNfJ9M4EVngs7di0ujIJz4h9aAXv
vbdYEBa97GNBprGaxXgewppYIvH+oz/HeB2VoF6UBRxmr+Crp9G4WlKdS1qc66od
QT9Ded3dKDibgEv7GoeESnbcZjPag+oOTZMTJzDglgidkCk02Z21BUktJxdMsD36
0ZRcGbxMCX/rQ8W2X5CymCkNHcX1qXfoMFZ/WvyXI28trLZ1rVXTU5KTzkGj6wHJ
gnTgvGIJFZ5EueGGurxZlctFwPAoFVfUZV3LiPl5/UCeCeeFup1IgF4VkNT6fL5e
lVCqcCDD39VOP7hRVSCWYtjcNc46XfvSecOrtK6qo9FQAJnO3mkzWmhum6y8Y8qm
L9Vh+Ow2grsjfbNmLSr8JuVlvOtL57310w5aQ39JYr7Im4PWQZY=
=OMym
-----END PGP SIGNATURE-----