-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 25 Jul 2026 21:40:31 +0000
Source: gpsd
Binary: gpsd gpsd-clients gpsd-clients-dbgsym gpsd-dbgsym gpsd-tools gpsd-tools-dbgsym libgps-dev libgps30t64 libgps30t64-dbgsym libqgpsmm-dev libqgpsmm30t64 libqgpsmm30t64-dbgsym python3-gps python3-gps-dbgsym
Architecture: s390x
Version: 3.25-5+deb13u2
Distribution: trixie
Urgency: medium
Maintainer: s390x Build Daemon (zandonai) <buildd_s390x-zandonai@buildd.debian.org>
Changed-By: Boian Bonev <bbonev@ipacct.com>
Description:
 gpsd       - Global Positioning System - daemon
 gpsd-clients - Global Positioning System - clients
 gpsd-tools - Global Positioning System - tools
 libgps-dev - Global Positioning System - development files
 libgps30t64 - Global Positioning System - library
 libqgpsmm-dev - Global Positioning System - Qt wrapper for libgps (development)
 libqgpsmm30t64 - Global Positioning System - Qt wrapper for libgps
 python3-gps - Global Positioning System - Python 3 libraries
Changes:
 gpsd (3.25-5+deb13u2) trixie; urgency=medium
 .
   * Fix CVE-2026-58459 (see #1141962). A command injection vulnerability
     exists in the gpsprof client. The subtype field, sourced from a
     DEVICES JSON log entry or an NMEA PGRMT sentence, is written into
     the generated gnuplot program via a set title statement with only
     double quote characters escaped. An attacker who controls the GPS
     device subtype can embed backtick payloads and execute arbitrary
     shell commands as the user running gnuplot when the generated plot
     is rendered.
   * Fix CVE-2026-60122. A code injection vulnerability exists in the
     gpsprof client. The SKY.satellites[].used field is inserted
     unsanitized into a gnuplot heredoc data block. An attacker who
     controls the GPS input data can supply a used value containing the
     string EOD to terminate the heredoc early and append gnuplot
     system() calls, achieving OS command execution as the user running
     gpsprof when the generated plot script is processed by gnuplot in
     polar mode.
Checksums-Sha1:
 12a4680cd2438f72d3de5ee7db0fd5f885ca1d98 1982632 gpsd-clients-dbgsym_3.25-5+deb13u2_s390x.deb
 ae69cece4bd866449aff305989e56c882b38417c 497436 gpsd-clients_3.25-5+deb13u2_s390x.deb
 f048ed9ea78080545ee293a52fb6fb00920dae95 2355544 gpsd-dbgsym_3.25-5+deb13u2_s390x.deb
 ae89e95e3261a85fa1cd2ddea744e0bdc92ededd 1614044 gpsd-tools-dbgsym_3.25-5+deb13u2_s390x.deb
 03561bc2b044eef7002468a7b5fbb16e50f9f7ee 334500 gpsd-tools_3.25-5+deb13u2_s390x.deb
 d8ca72641bdb2f452ba75d6135975d7e2e8bdbfc 20880 gpsd_3.25-5+deb13u2_s390x-buildd.buildinfo
 4dc12f7e6d1392f5b76a40dea09c7fe696a0e0ab 409136 gpsd_3.25-5+deb13u2_s390x.deb
 bbf4101194dcbde60c7ac0817abcbc6257ac5867 145424 libgps-dev_3.25-5+deb13u2_s390x.deb
 74b69d4ee4f035123a7b1228f76f560273fb97d8 170936 libgps30t64-dbgsym_3.25-5+deb13u2_s390x.deb
 e51cfd5fe92742ae06ecbf8ceb93f3a8e3616d13 85108 libgps30t64_3.25-5+deb13u2_s390x.deb
 9ac0b37457232e60c5ad234e7b5b4d9f4b0a8f61 34608 libqgpsmm-dev_3.25-5+deb13u2_s390x.deb
 6587ad1375e84d51df66745be9b0a7cc9ea99754 401680 libqgpsmm30t64-dbgsym_3.25-5+deb13u2_s390x.deb
 b17cc5e1cd5b43ffdf204dc1757d7e019f3c822d 87120 libqgpsmm30t64_3.25-5+deb13u2_s390x.deb
 255c0acc63b818ba1f330d58b8634bf87a22399d 64488 python3-gps-dbgsym_3.25-5+deb13u2_s390x.deb
 65c793f24ed2bf0201846df421eed492d84e0423 152748 python3-gps_3.25-5+deb13u2_s390x.deb
Checksums-Sha256:
 7dc14a4ec36fe8b156dd1a910ffee3dbded9b94db3676e19953a9e7e27feefa2 1982632 gpsd-clients-dbgsym_3.25-5+deb13u2_s390x.deb
 e2fec60737b36ddd23cf251946cd645517db4edd3db6a606e5146161ff2ebb4a 497436 gpsd-clients_3.25-5+deb13u2_s390x.deb
 f37c35e710f8966ceeea039cfdf43ea64d73f528cd45206f44f9be10fd919134 2355544 gpsd-dbgsym_3.25-5+deb13u2_s390x.deb
 a5cc82cf8147a05a8230f179c11348e5dc460238eef48a17a8e1e6f718159cee 1614044 gpsd-tools-dbgsym_3.25-5+deb13u2_s390x.deb
 3b1a77349251c21e6a65664478196daaf098d5998f9fbfb00bb2be3edee29fdc 334500 gpsd-tools_3.25-5+deb13u2_s390x.deb
 0feeb7e2218bf0318fb7603493f73bb9a4eccdbfaea3be8bebb6b0d2845a404e 20880 gpsd_3.25-5+deb13u2_s390x-buildd.buildinfo
 2d8b6d1f4bc68ce90df7db51943b7bb4ec0e4fd65a1141f6fe8df2ab40432b1c 409136 gpsd_3.25-5+deb13u2_s390x.deb
 329b503a9ad277d86fcbc7238ad734c30f135ca1a7c26a7f00cd94747b1194e5 145424 libgps-dev_3.25-5+deb13u2_s390x.deb
 472d3b2ddb55f128f43258860a2d44744ff8963c0cd48657d88c566b1c317ac3 170936 libgps30t64-dbgsym_3.25-5+deb13u2_s390x.deb
 e53ab1f6937b55fcac8e798709ae8ea7013d72a6f2e6f410549cd8909c16ab1a 85108 libgps30t64_3.25-5+deb13u2_s390x.deb
 88d967e103e89224be4c9f502a600c49be4c15f34725ad7d32ed06a8781caf63 34608 libqgpsmm-dev_3.25-5+deb13u2_s390x.deb
 e43feaec08893a116ebc1b5128194f65246aa4c40517cb064cbac49ff5c9cdff 401680 libqgpsmm30t64-dbgsym_3.25-5+deb13u2_s390x.deb
 df2b845d43b90d67d7281c7b3928b109a58777be0db6c56d63e3c070f992567b 87120 libqgpsmm30t64_3.25-5+deb13u2_s390x.deb
 dc8c21e6d5fc6231daed0eafd5543812573bb5fc81a47719628ee2f304b1572a 64488 python3-gps-dbgsym_3.25-5+deb13u2_s390x.deb
 fcbb54afa5ff227b66a56c86a905874c30dfaf24cd04d94121baad503517c30b 152748 python3-gps_3.25-5+deb13u2_s390x.deb
Files:
 13f992b48b5acc0d358383604b9c986d 1982632 debug optional gpsd-clients-dbgsym_3.25-5+deb13u2_s390x.deb
 160a2ca38246b43e48963d93b63b3305 497436 misc optional gpsd-clients_3.25-5+deb13u2_s390x.deb
 a05c59685776d7683a326ab19e20c90e 2355544 debug optional gpsd-dbgsym_3.25-5+deb13u2_s390x.deb
 90e8211fc19c6d6dc9c30c337b048ff4 1614044 debug optional gpsd-tools-dbgsym_3.25-5+deb13u2_s390x.deb
 8a6a5c7399547dd830bc4a16eca31bcd 334500 misc optional gpsd-tools_3.25-5+deb13u2_s390x.deb
 cdd2b1a7e038cfe89f3666658621ce38 20880 misc optional gpsd_3.25-5+deb13u2_s390x-buildd.buildinfo
 fe7466d362168ec4533725d7d3b5e8d3 409136 misc optional gpsd_3.25-5+deb13u2_s390x.deb
 ab9cb3e19fcf607bbf58b578fff85fcb 145424 libdevel optional libgps-dev_3.25-5+deb13u2_s390x.deb
 310a83140c74df681068dad41565a074 170936 debug optional libgps30t64-dbgsym_3.25-5+deb13u2_s390x.deb
 8fd7add62544b2a5ddfd241780825c89 85108 libs optional libgps30t64_3.25-5+deb13u2_s390x.deb
 f7a94fa2163d1aa9255398b94716a036 34608 libdevel optional libqgpsmm-dev_3.25-5+deb13u2_s390x.deb
 cb92b7a06340ddfcdb60b2fdac3f2b4f 401680 debug optional libqgpsmm30t64-dbgsym_3.25-5+deb13u2_s390x.deb
 12facc15ecfdbfe52f0de07d2e75cb21 87120 libs optional libqgpsmm30t64_3.25-5+deb13u2_s390x.deb
 c1a424634d2fa5a796e18ffd5144e954 64488 debug optional python3-gps-dbgsym_3.25-5+deb13u2_s390x.deb
 e6ad9b38fc4281ec5ecbd5b139f4ee02 152748 python optional python3-gps_3.25-5+deb13u2_s390x.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEENly2ANlpa4eeqnluvVOPI7pYNpgFAmpmL5oACgkQvVOPI7pY
NpjYgRAAq+LIiVTKiWmVKcuh4f6VfDr6A5bKBQ1HBlgm+WXzKiErJdXxzfzCCREg
hYXtGg57lbMtUfucyJEOFmBrKSbOkBaAk6Q+/Ejn/OzljcI43OR+2wDsTtL0FA3T
endqh6QaUO37eoT7Mz6sq1RyTDMrJ+V4COM2DWqOe4lg6hdNiigCKyke6lVmmtMT
VzxMOILFgtdxRkpYk3L1J4WwNLzliHREjfDH8sIxEpxhXi8qE8sCyGzM8SI3aSdj
Vf5ffdnQU389d0ZuzU7+q/up4phLD605ouiY3yQzqG2/Y+/y9JWbdDC4K8ikjZs9
DhQh5h7jrIWtWXSJrU5Y4dpYsHGq2QZdH5qC3ZsTTQwZwVlK3z07LXIX0vD8g4c/
/2FnebMxWQ0HY2eg0ex7jKPrSc5YpDkKIkhjjollAFLfbwE3hixceDa/h+hIa18X
KnDoZSdLKnbz6jqh41caI1cr4vEfnmM1ozBQWLi7vLDs3pCf/Rog0E8HIupnqoJz
PiG/zyXsE55PBT9mxTqfzIEB3WKfeBaFDVcRtAZxSaUS/dKAP25W7ujiFjnwL0pb
E9Yq2+kTS3lO48u2mta31xTh5ab8ScK+4LWSOzTVPsx+qYNqj9g5UETNmtX5jTdu
WBtQD1eY0YhDDfonA12hSx856iULch15BSP1Szej5CvgYnPgB0w=
=4Hq1
-----END PGP SIGNATURE-----