-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 25 Jul 2026 21:40:31 +0000 Source: gpsd Binary: gpsd gpsd-clients gpsd-clients-dbgsym gpsd-dbgsym gpsd-tools gpsd-tools-dbgsym libgps-dev libgps30t64 libgps30t64-dbgsym libqgpsmm-dev libqgpsmm30t64 libqgpsmm30t64-dbgsym python3-gps python3-gps-dbgsym Architecture: riscv64 Version: 3.25-5+deb13u2 Distribution: trixie Urgency: medium Maintainer: riscv64 Build Daemon (rv-osuosl-04) Changed-By: Boian Bonev Description: gpsd - Global Positioning System - daemon gpsd-clients - Global Positioning System - clients gpsd-tools - Global Positioning System - tools libgps-dev - Global Positioning System - development files libgps30t64 - Global Positioning System - library libqgpsmm-dev - Global Positioning System - Qt wrapper for libgps (development) libqgpsmm30t64 - Global Positioning System - Qt wrapper for libgps python3-gps - Global Positioning System - Python 3 libraries Changes: gpsd (3.25-5+deb13u2) trixie; urgency=medium . * Fix CVE-2026-58459 (see #1141962). A command injection vulnerability exists in the gpsprof client. The subtype field, sourced from a DEVICES JSON log entry or an NMEA PGRMT sentence, is written into the generated gnuplot program via a set title statement with only double quote characters escaped. An attacker who controls the GPS device subtype can embed backtick payloads and execute arbitrary shell commands as the user running gnuplot when the generated plot is rendered. * Fix CVE-2026-60122. A code injection vulnerability exists in the gpsprof client. The SKY.satellites[].used field is inserted unsanitized into a gnuplot heredoc data block. An attacker who controls the GPS input data can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode. Checksums-Sha1: 20c0672d15050ec264a1eff20c8d3309bd6fcdf1 1933108 gpsd-clients-dbgsym_3.25-5+deb13u2_riscv64.deb e3e539ce16bce17e101df0eb1e57869919a2a14d 532964 gpsd-clients_3.25-5+deb13u2_riscv64.deb 69c07564e7d6406742a7765c6d4993631a222df0 2272876 gpsd-dbgsym_3.25-5+deb13u2_riscv64.deb d394ef1a2a366316347d7b8b7896b3ab5dce82f4 1569524 gpsd-tools-dbgsym_3.25-5+deb13u2_riscv64.deb 25185662124c1db1c35be6483e3dbad6a2a01c32 369368 gpsd-tools_3.25-5+deb13u2_riscv64.deb 6c8fdf4fd779fc374d34820706b6e151bfe5cb74 21092 gpsd_3.25-5+deb13u2_riscv64-buildd.buildinfo c6117d691e876bca6cd0d1e790fa81d6c1d3077e 447536 gpsd_3.25-5+deb13u2_riscv64.deb 98e71f31b044595b6e7a460de87d9ae21de4e54a 199804 libgps-dev_3.25-5+deb13u2_riscv64.deb 5c113d11b3a9dc28e49e985f7445f33cff1aaf0e 169552 libgps30t64-dbgsym_3.25-5+deb13u2_riscv64.deb 2ea91be06f6f52b9c2e74632840944f64d2383f9 91640 libgps30t64_3.25-5+deb13u2_riscv64.deb 27c55b633341660f52b49c3593584fab8fd9b7f8 34608 libqgpsmm-dev_3.25-5+deb13u2_riscv64.deb 2ba1b655fb8ebd8b82adb6000fb0ecb644a04008 392420 libqgpsmm30t64-dbgsym_3.25-5+deb13u2_riscv64.deb 9c9ce0928a7bca97a22e025c9aee857f50c15e06 93684 libqgpsmm30t64_3.25-5+deb13u2_riscv64.deb 68f5401a3371f5fe6f93c23288c7b855b2901aa8 64068 python3-gps-dbgsym_3.25-5+deb13u2_riscv64.deb 8ff91a28da1c9063e6afa0ec4f3d365839b56973 153140 python3-gps_3.25-5+deb13u2_riscv64.deb Checksums-Sha256: 620e0fee37c7509fca28036acbfa8146a65dae51dcc87a7e6879d3d810c02292 1933108 gpsd-clients-dbgsym_3.25-5+deb13u2_riscv64.deb 88eb35ecaa5ff805771730cc0c04be545871d8b58581056b0799ad5dee7fc09b 532964 gpsd-clients_3.25-5+deb13u2_riscv64.deb 6eba400a8da79bef7d49e0eb76a7d049917b4c53612efd4e32310da58bdfc781 2272876 gpsd-dbgsym_3.25-5+deb13u2_riscv64.deb deb40f1299653b5c1c0043bc2c16633f1616fbff3329fb45c413683fb93c4860 1569524 gpsd-tools-dbgsym_3.25-5+deb13u2_riscv64.deb e722f66357e0c349394886b2df444c92219b23facbc4dcbb4991711d5cea7c6b 369368 gpsd-tools_3.25-5+deb13u2_riscv64.deb 988d6f86fcba68c77dbcd704f27345ea72390b77624ae8ca8e19e147383b4cc3 21092 gpsd_3.25-5+deb13u2_riscv64-buildd.buildinfo bc9ed44b687a840b742ce3b182760c683be218b7e0c9b2bddd39e707205ac033 447536 gpsd_3.25-5+deb13u2_riscv64.deb e119f17d54b1fc7feaad0a69ec6f669ed09a6dcfd815f982269dee2157dee3fe 199804 libgps-dev_3.25-5+deb13u2_riscv64.deb 3bd0a2ebae05231a682071c4503eda9cfefa423299b11edc707a8aa15b88955c 169552 libgps30t64-dbgsym_3.25-5+deb13u2_riscv64.deb e399a58ab3bb59d236fc859b5e47224664ca4a9d25e3fecff294edcf5de711b5 91640 libgps30t64_3.25-5+deb13u2_riscv64.deb bd1912d7875937f7fc9816fd08323c1549efa2e28dcfe8734651810d51494cf3 34608 libqgpsmm-dev_3.25-5+deb13u2_riscv64.deb af6c66c8f731d89c7c90532926d07d52383736bdee7555b36e708dac54dcd6cd 392420 libqgpsmm30t64-dbgsym_3.25-5+deb13u2_riscv64.deb 1396dc32c256ecf2a97e62e31e8be8aee1d593827ad7fba48d523c8ad35439a9 93684 libqgpsmm30t64_3.25-5+deb13u2_riscv64.deb 09e5f8d5338faa114adeb1aed5ed63f8750ebf07d790c771def876bcc88ae56a 64068 python3-gps-dbgsym_3.25-5+deb13u2_riscv64.deb 505a24f10f467fadcdd4a688d168a693cf85920fe2bfb9260b3e5b9b99167ce8 153140 python3-gps_3.25-5+deb13u2_riscv64.deb Files: 4dbe3fd8f2aafd23ea8237af032347e9 1933108 debug optional gpsd-clients-dbgsym_3.25-5+deb13u2_riscv64.deb ba8a338c5107fe1d163e5610db11cb47 532964 misc optional gpsd-clients_3.25-5+deb13u2_riscv64.deb 7c75e397b07392d5600e029b6b318a73 2272876 debug optional gpsd-dbgsym_3.25-5+deb13u2_riscv64.deb c0024358a69c3bf5ea31ee3c2071a0d7 1569524 debug optional gpsd-tools-dbgsym_3.25-5+deb13u2_riscv64.deb 6363931968db36b009cab7d6e9be4122 369368 misc optional gpsd-tools_3.25-5+deb13u2_riscv64.deb 060ebe3f42f75b6c9c421b39dc73f86f 21092 misc optional gpsd_3.25-5+deb13u2_riscv64-buildd.buildinfo 427404ca88a5318ed2850ac6165a4bca 447536 misc optional gpsd_3.25-5+deb13u2_riscv64.deb 56c8be24a510797082345c1d6c9d82de 199804 libdevel optional libgps-dev_3.25-5+deb13u2_riscv64.deb ace740254631d9360b94cad74f0057c5 169552 debug optional libgps30t64-dbgsym_3.25-5+deb13u2_riscv64.deb c58034588e675fbe73561088be9c854f 91640 libs optional libgps30t64_3.25-5+deb13u2_riscv64.deb ff818fd1438f0033ad473893463c2aaa 34608 libdevel optional libqgpsmm-dev_3.25-5+deb13u2_riscv64.deb ea55a805d81c0045f9820207fd0c807b 392420 debug optional libqgpsmm30t64-dbgsym_3.25-5+deb13u2_riscv64.deb f1f981ad1ece9de5b78cab0bd390b0c8 93684 libs optional libqgpsmm30t64_3.25-5+deb13u2_riscv64.deb 985fc5411b9c8b20e63081c1355518a8 64068 debug optional python3-gps-dbgsym_3.25-5+deb13u2_riscv64.deb f9e659f3d71adc7f045b474cd3171a75 153140 python optional python3-gps_3.25-5+deb13u2_riscv64.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEgLDDByWcR07HDSHyNVgvumj7+mMFAmpmNsoACgkQNVgvumj7 +mO06RAAtiyZjxSSzE5Hpp9c3XKK06eaThSDpYOSsM9Kfs6zb1yn0pDzZc1avXxb iKN7TEd7RhRYtrLAyigRcAXJ6wjvCHGOhR/w7ogQHNLoiV7fSxOMhEhmiX61Jc4I AbXAlEAC7ICVX3Us/5syZ6LtVdy5v62XR+lpV9i8EtaX69P97qbMvHegQzp0eEKE ycfK7IiNMlLQsBjUmxYrDpb3P7gfm6tVnQ47Yt/cCUesjEopVUsjiVEWA/6WHzGo DqjaXtM+HLJkkbrCYiihcsrzL70MNpGBrSX8R9PGv6m7e4jUB6IfKDeVropiesl+ BDD3PFSR6SQWmwK8voX8BAKJ5S07cC7FjdYCqC2OKepWfliBtcGBqfHcxPbzTMIW Do0K99o3nmko0vTW2rkcKB/o+OkAj6Ae7+HDvxQHv8in8/gdZUzEv7o/JkIh2j5X Z3CDAFgP/loessDFIItGG/p5Kk6lmyvudNKO4RXz1z3dFB4GG1KW/GGDPXrrLkK2 7G+qgLiNHgs+fqKzg0flPMv8kvWp5pWJgcqSCmMqKAnA3RhxiTOZnXTugtszjYsj aApp6H5WGHq0rzIa+7Sycn73xl6NXiHt0NCqjm7JJAn1/4SqWZmyxTGD1tW1FJ6t C3sBVIAm0/z1PEmSbZUsIR/Egw3fIfyJjmSZNxI294fysiTxQAg= =kSyb -----END PGP SIGNATURE-----