-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 25 Jul 2026 21:40:31 +0000 Source: gpsd Binary: gpsd gpsd-clients gpsd-clients-dbgsym gpsd-dbgsym gpsd-tools gpsd-tools-dbgsym libgps-dev libgps30t64 libgps30t64-dbgsym libqgpsmm-dev libqgpsmm30t64 libqgpsmm30t64-dbgsym python3-gps python3-gps-dbgsym Architecture: ppc64el Version: 3.25-5+deb13u2 Distribution: trixie Urgency: medium Maintainer: ppc64el Build Daemon (ppc64el-osuosl-02) Changed-By: Boian Bonev Description: gpsd - Global Positioning System - daemon gpsd-clients - Global Positioning System - clients gpsd-tools - Global Positioning System - tools libgps-dev - Global Positioning System - development files libgps30t64 - Global Positioning System - library libqgpsmm-dev - Global Positioning System - Qt wrapper for libgps (development) libqgpsmm30t64 - Global Positioning System - Qt wrapper for libgps python3-gps - Global Positioning System - Python 3 libraries Changes: gpsd (3.25-5+deb13u2) trixie; urgency=medium . * Fix CVE-2026-58459 (see #1141962). A command injection vulnerability exists in the gpsprof client. The subtype field, sourced from a DEVICES JSON log entry or an NMEA PGRMT sentence, is written into the generated gnuplot program via a set title statement with only double quote characters escaped. An attacker who controls the GPS device subtype can embed backtick payloads and execute arbitrary shell commands as the user running gnuplot when the generated plot is rendered. * Fix CVE-2026-60122. A code injection vulnerability exists in the gpsprof client. The SKY.satellites[].used field is inserted unsanitized into a gnuplot heredoc data block. An attacker who controls the GPS input data can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode. Checksums-Sha1: df8a990b893f0a978bf95fd4cb861769baa5c201 1992828 gpsd-clients-dbgsym_3.25-5+deb13u2_ppc64el.deb 84ab8eb425cda8cb215bb794b3316079ac539dd0 518232 gpsd-clients_3.25-5+deb13u2_ppc64el.deb 75bebc79d93ba0dd7579ff28251d648eed81df84 2351252 gpsd-dbgsym_3.25-5+deb13u2_ppc64el.deb de7213ff955efc2ec180eef1d4f339d43464fe42 1612444 gpsd-tools-dbgsym_3.25-5+deb13u2_ppc64el.deb e88951e7cf31f75368a3897a80a135cfca520ae4 356992 gpsd-tools_3.25-5+deb13u2_ppc64el.deb ae70a641e33d47b7af44d1cc25b59be8e019cb87 21115 gpsd_3.25-5+deb13u2_ppc64el-buildd.buildinfo 0d4c9f6410efd27be127d0eb2a5c2bcefac2228d 437028 gpsd_3.25-5+deb13u2_ppc64el.deb 3f767bd706f2180991de58e1ee22c6580b4090b6 153220 libgps-dev_3.25-5+deb13u2_ppc64el.deb ec693b0470bfafc1743d9daf5c9eedcdad83bd88 173956 libgps30t64-dbgsym_3.25-5+deb13u2_ppc64el.deb 4e9f4629eac0a38fb812ffe7343de07a098158be 92428 libgps30t64_3.25-5+deb13u2_ppc64el.deb be2390ba2851041c5c24981038e40819f9f91427 34608 libqgpsmm-dev_3.25-5+deb13u2_ppc64el.deb d5733fd31c307099ed4e273d43b3e02d6571dde1 399964 libqgpsmm30t64-dbgsym_3.25-5+deb13u2_ppc64el.deb 8de614a6700d844da1cc6757465f71ad4fc5bd7e 94580 libqgpsmm30t64_3.25-5+deb13u2_ppc64el.deb 87fbb42a72434c323fee15f9950a50d561a856da 64728 python3-gps-dbgsym_3.25-5+deb13u2_ppc64el.deb cff87c3afe2c611b6d192d8f3b6bdf16621985aa 153496 python3-gps_3.25-5+deb13u2_ppc64el.deb Checksums-Sha256: dca6e957b6e758262ef5b3b4b68e5f27e56a3fe9bd85bd212364c0b9d959d46e 1992828 gpsd-clients-dbgsym_3.25-5+deb13u2_ppc64el.deb 4d85564f86c0a360fde332de2f8e1ced45b93b6c8ff1f1138c065178a37e4229 518232 gpsd-clients_3.25-5+deb13u2_ppc64el.deb 5d2fb58a911c94836050c22e995eec59a2bc53d98c7d08a88b84966dec560509 2351252 gpsd-dbgsym_3.25-5+deb13u2_ppc64el.deb 9a8cc20d9cc8ccfba4df76f23b4d509e7d68eba66f587b8645ba82bfea099427 1612444 gpsd-tools-dbgsym_3.25-5+deb13u2_ppc64el.deb 1693cb71a514f37456a1f87668b7f18c3d3b8a6765239c4b903880501cf7af28 356992 gpsd-tools_3.25-5+deb13u2_ppc64el.deb e2a92bfc2d133f4e642708ce8699c27db0bb9f1c7bd45d2c27533533f94f2743 21115 gpsd_3.25-5+deb13u2_ppc64el-buildd.buildinfo 8bf0b8534429523279b28535df682021538d45c9e61bb3c4161dabeed6350ecd 437028 gpsd_3.25-5+deb13u2_ppc64el.deb 4c0fee0c1e6d17cf425edf61d6173c898469384092291cd14abc7bd60b511ad4 153220 libgps-dev_3.25-5+deb13u2_ppc64el.deb 02e2a28f5a270ab342f96f611772e526990c27aed0f2f7d2ea6181ed83747746 173956 libgps30t64-dbgsym_3.25-5+deb13u2_ppc64el.deb 6280c36069006490999c4a0503b3508fd23ebeec71e6d849fa8f3b17a2eecf91 92428 libgps30t64_3.25-5+deb13u2_ppc64el.deb c0325c24129abfb2c1ca733171230d751e0f7b99efe7368fc9c98abf360829fb 34608 libqgpsmm-dev_3.25-5+deb13u2_ppc64el.deb af73edf45e454bcfa5c325ce689d29edd1ff90e03f9c8354cb9fa40c05f143d8 399964 libqgpsmm30t64-dbgsym_3.25-5+deb13u2_ppc64el.deb 72b09b3acc6d56650efcd9704cdc899028af96b3e5c320ff17f4c5e74101a07c 94580 libqgpsmm30t64_3.25-5+deb13u2_ppc64el.deb 26daae57b0250b9cce0c35236ef7bb766b1b91de285a8f712704e4283cb1a6ad 64728 python3-gps-dbgsym_3.25-5+deb13u2_ppc64el.deb 541b1ecaffba7675f34abcdee51407b36384fb27e0b3a6a52922d3258003cfdc 153496 python3-gps_3.25-5+deb13u2_ppc64el.deb Files: c4a93ed4f231c35d5540bbc4bf4a5381 1992828 debug optional gpsd-clients-dbgsym_3.25-5+deb13u2_ppc64el.deb 3dda7b63158008d7a643748ed6dcbcae 518232 misc optional gpsd-clients_3.25-5+deb13u2_ppc64el.deb c46a57cbfe8a7ad05640976f5ce9b4dc 2351252 debug optional gpsd-dbgsym_3.25-5+deb13u2_ppc64el.deb b80b0d2753faaeca12e2638425a3f37e 1612444 debug optional gpsd-tools-dbgsym_3.25-5+deb13u2_ppc64el.deb caf0d1a1b6e594adcd847dcc6c1ac043 356992 misc optional gpsd-tools_3.25-5+deb13u2_ppc64el.deb 2183cdbf072e3e55e6760dc99293b4ba 21115 misc optional gpsd_3.25-5+deb13u2_ppc64el-buildd.buildinfo 6232326d1fd0e14bfa026f53b38719eb 437028 misc optional gpsd_3.25-5+deb13u2_ppc64el.deb e1c5ebd7b17889417a2db478bc71c108 153220 libdevel optional libgps-dev_3.25-5+deb13u2_ppc64el.deb 13e5f7a36c7caaaa56f6b8d94a09fe17 173956 debug optional libgps30t64-dbgsym_3.25-5+deb13u2_ppc64el.deb c57b0ebe092f6ccd49345c7993e29c1a 92428 libs optional libgps30t64_3.25-5+deb13u2_ppc64el.deb 33b36e56d53c5d0ab824130d80e8681d 34608 libdevel optional libqgpsmm-dev_3.25-5+deb13u2_ppc64el.deb 1f2bb77bda910f03707bb0836ae1dbc6 399964 debug optional libqgpsmm30t64-dbgsym_3.25-5+deb13u2_ppc64el.deb 9f16c6aed77d07d268c316e49ab958e5 94580 libs optional libqgpsmm30t64_3.25-5+deb13u2_ppc64el.deb 77e0a8468469fae4978507bc352aa0f6 64728 debug optional python3-gps-dbgsym_3.25-5+deb13u2_ppc64el.deb f48288c6e42d3a92c0d20b3e411d4170 153496 python optional python3-gps_3.25-5+deb13u2_ppc64el.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE9ibmwdV9gdKNbK7oV8ucRsMTpuMFAmpmL4cACgkQV8ucRsMT puOiQRAArBGRpq76nfxksEyop/TQOGEhD0/VkS2pYzrFsX7VooPbdK/Ah/mZgaEO 1Bs0+vOQDNPQ8JD5cHQXhJyGaYModkB6cPkifC0E8e83WSEzzKB68Cn1j1RpNxSM HoWXjSuRXIYKbLJKzlEv0AHNJZTbOzmsInxeYO/VrVx/bFl42F4vxnGHejp48/RW FrHoG8JU3HXrReKSUKw6ibJjmrm7xDNhIEESOp0PDhYbHoeIRpte3i0rjz8kfmMq 1SPzfUy8k6u94NzwSDGVDdn9NGzTlbuM1Lwr4SdaXRxeg0wIC0mar1rpWYYmy0sV A9ig6+D6BX23Rq7fzraVh5LiNd6+6Xe6iUrJcsWjPQutKlIx8znIlW4xQHhoRUee LRVOEIfePPYqSsgBJyZzlQXRBlkS4zagVf2JOWuZwcF2uYr4/jK3YeG8xMn5tS+H mPF7lCUtXGWXY3Q33+wD6qITu6N0CwxaTCtF0jahnMEMVgK1HzUc0r7H5IpTgew1 aFrTVi1/UuRcxsBSZPjoyzawVG+YdVzAgrZgep4i2wQ8YE+p5tro+hzhFFfnWPU1 uE691bo0BfgtU5BGTjP/+k7Jhvd7iS1FYocFVGhky3oVtcPVwE40TZuXxgNVjlyn NqKolfLS58/wDBQcbb4wUUM0NGCiR+NMlkBJBGrht4GqN1IVikw= =H8OR -----END PGP SIGNATURE-----