-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 25 Jul 2026 21:40:31 +0000
Source: gpsd
Binary: gpsd gpsd-clients gpsd-clients-dbgsym gpsd-dbgsym gpsd-tools gpsd-tools-dbgsym libgps-dev libgps30t64 libgps30t64-dbgsym libqgpsmm-dev libqgpsmm30t64 libqgpsmm30t64-dbgsym python3-gps python3-gps-dbgsym
Architecture: i386
Version: 3.25-5+deb13u2
Distribution: trixie
Urgency: medium
Maintainer: amd64 / i386 Build Daemon (x86-csail-01) <buildd_amd64-x86-csail-01@buildd.debian.org>
Changed-By: Boian Bonev <bbonev@ipacct.com>
Description:
 gpsd       - Global Positioning System - daemon
 gpsd-clients - Global Positioning System - clients
 gpsd-tools - Global Positioning System - tools
 libgps-dev - Global Positioning System - development files
 libgps30t64 - Global Positioning System - library
 libqgpsmm-dev - Global Positioning System - Qt wrapper for libgps (development)
 libqgpsmm30t64 - Global Positioning System - Qt wrapper for libgps
 python3-gps - Global Positioning System - Python 3 libraries
Changes:
 gpsd (3.25-5+deb13u2) trixie; urgency=medium
 .
   * Fix CVE-2026-58459 (see #1141962). A command injection vulnerability
     exists in the gpsprof client. The subtype field, sourced from a
     DEVICES JSON log entry or an NMEA PGRMT sentence, is written into
     the generated gnuplot program via a set title statement with only
     double quote characters escaped. An attacker who controls the GPS
     device subtype can embed backtick payloads and execute arbitrary
     shell commands as the user running gnuplot when the generated plot
     is rendered.
   * Fix CVE-2026-60122. A code injection vulnerability exists in the
     gpsprof client. The SKY.satellites[].used field is inserted
     unsanitized into a gnuplot heredoc data block. An attacker who
     controls the GPS input data can supply a used value containing the
     string EOD to terminate the heredoc early and append gnuplot
     system() calls, achieving OS command execution as the user running
     gpsprof when the generated plot script is processed by gnuplot in
     polar mode.
Checksums-Sha1:
 9b7dbf937eb6c6fa69bdf182807f96b2c69167f7 1808160 gpsd-clients-dbgsym_3.25-5+deb13u2_i386.deb
 7722f1c32849fb745a7973fee871b59e9c7e6cca 517764 gpsd-clients_3.25-5+deb13u2_i386.deb
 a0b3e347e89b62cf2517378a8a98e779adaf7d8a 2146744 gpsd-dbgsym_3.25-5+deb13u2_i386.deb
 0a1bda896321a76d0b72d64afa5b251f19476134 1468080 gpsd-tools-dbgsym_3.25-5+deb13u2_i386.deb
 aaadb8e5b63e2919986ed3a9844e3a9480b06ca3 357648 gpsd-tools_3.25-5+deb13u2_i386.deb
 2d505d69b5c2f29a1706c40195509cd6a06cfcc0 20969 gpsd_3.25-5+deb13u2_i386-buildd.buildinfo
 aad93be0f0399a9550d61a5b226c36909b6c7c4e 438220 gpsd_3.25-5+deb13u2_i386.deb
 201f0df25afd5a8bd6a31fdeb5e5a7f183409f4c 149480 libgps-dev_3.25-5+deb13u2_i386.deb
 e6fe4e0a8df4f6ea0c4002d341db03f53a77467c 159156 libgps30t64-dbgsym_3.25-5+deb13u2_i386.deb
 43696e6812d04ee2f497638c81702d9d818e472f 88596 libgps30t64_3.25-5+deb13u2_i386.deb
 a6912c0ab4d117e0d454c6a0559d9e3436d18152 34592 libqgpsmm-dev_3.25-5+deb13u2_i386.deb
 345de8ceb569346ca2eac8cd0e6b88d668c69ba9 386808 libqgpsmm30t64-dbgsym_3.25-5+deb13u2_i386.deb
 e9a9441d36cdb49232d3d1fa7702796a4b674331 90544 libqgpsmm30t64_3.25-5+deb13u2_i386.deb
 ccf46ee79a065274bdca0d9407abc4f9441352d6 63496 python3-gps-dbgsym_3.25-5+deb13u2_i386.deb
 af2be4381fe0907e24a11b783f1836e49f157f4f 153416 python3-gps_3.25-5+deb13u2_i386.deb
Checksums-Sha256:
 ff0db36c695478de804a569a560e1a7a1a7594b7e5be172cc5677b6508827835 1808160 gpsd-clients-dbgsym_3.25-5+deb13u2_i386.deb
 a1d20ff4991b46267b6af442148dd725c2875eecf1d2f64bc7d87231989e783a 517764 gpsd-clients_3.25-5+deb13u2_i386.deb
 30df18b09c316d5218c8b44416e3a968ad434a56f225203b00785980b468cf54 2146744 gpsd-dbgsym_3.25-5+deb13u2_i386.deb
 829080d761a968b8f5dfb52f2dc18a2c2120871fe3a4c990a8f256da71cdb923 1468080 gpsd-tools-dbgsym_3.25-5+deb13u2_i386.deb
 139d7c364c560c26eb12f8a83fbab04232a505caca87d1e13d07f70ae6a2ae64 357648 gpsd-tools_3.25-5+deb13u2_i386.deb
 c421649aa7816e6bd51fdc9feefd50df5228b59dc9b0365de7abd781e88fa393 20969 gpsd_3.25-5+deb13u2_i386-buildd.buildinfo
 48ef32396a5510fd01efc22006de0d921a1dd33ff8b90ef778eecf5530b5374c 438220 gpsd_3.25-5+deb13u2_i386.deb
 6d849a57a7045058563fbed175340989b661316d75b79acd94bba32365b6730d 149480 libgps-dev_3.25-5+deb13u2_i386.deb
 03f8236b6480e4468f5dd3f2dcb21d9f7eb964f99ad27e5706a51fabfa1839cc 159156 libgps30t64-dbgsym_3.25-5+deb13u2_i386.deb
 486d211f2d584e82e90f843c0631d483327b05d535c813c6ee8788359474d51b 88596 libgps30t64_3.25-5+deb13u2_i386.deb
 247e2762f2934513981b6ad4b9ecff151e0507cd81e449a981a9fa83d746a557 34592 libqgpsmm-dev_3.25-5+deb13u2_i386.deb
 85752d315ee91bdde70ee21e012a005a4a37d684718f2acaaf7300e2833187df 386808 libqgpsmm30t64-dbgsym_3.25-5+deb13u2_i386.deb
 328311fb4c1519f02595c6a5efdba6e92c72a715038fd51f025240427daf01d5 90544 libqgpsmm30t64_3.25-5+deb13u2_i386.deb
 967ab08f0553d6528fd0fc43c147a43de35c52f61008e184bb8c715c52f3c807 63496 python3-gps-dbgsym_3.25-5+deb13u2_i386.deb
 7cc0fdb589e141a46a6bcf2d4260bc83ccc041a69ddf6ef4d9ac64582ca38f80 153416 python3-gps_3.25-5+deb13u2_i386.deb
Files:
 74e446f4a82aa0c7353a9c3fd51208c1 1808160 debug optional gpsd-clients-dbgsym_3.25-5+deb13u2_i386.deb
 ed83575c1725d03f2bd608691826a17b 517764 misc optional gpsd-clients_3.25-5+deb13u2_i386.deb
 6a4ac6db2b503662f2c22a1ac2492da2 2146744 debug optional gpsd-dbgsym_3.25-5+deb13u2_i386.deb
 d1e5e6393bcf945d2fba41cc67bfb7d5 1468080 debug optional gpsd-tools-dbgsym_3.25-5+deb13u2_i386.deb
 014b85ee74d5875344ee6d5384485b97 357648 misc optional gpsd-tools_3.25-5+deb13u2_i386.deb
 b9bb9175b93c827850065f0dab933b95 20969 misc optional gpsd_3.25-5+deb13u2_i386-buildd.buildinfo
 884e0aadbf6306e2a6ae6c8aaf24e3c6 438220 misc optional gpsd_3.25-5+deb13u2_i386.deb
 cc4145770d431ad24df24bbc4d3dafc2 149480 libdevel optional libgps-dev_3.25-5+deb13u2_i386.deb
 536deb2daa06b88510328d09681095c9 159156 debug optional libgps30t64-dbgsym_3.25-5+deb13u2_i386.deb
 161e2ad9343f68e00ba5d28170316eee 88596 libs optional libgps30t64_3.25-5+deb13u2_i386.deb
 16344adb66145cb950c5b13d58d932a2 34592 libdevel optional libqgpsmm-dev_3.25-5+deb13u2_i386.deb
 ed1d28bc998bd91fd843dcf125e2736c 386808 debug optional libqgpsmm30t64-dbgsym_3.25-5+deb13u2_i386.deb
 5d67ff07c5290ac77b509f4c1cb80ff3 90544 libs optional libqgpsmm30t64_3.25-5+deb13u2_i386.deb
 23d0320fc59e54b83831bc53d4214dc4 63496 debug optional python3-gps-dbgsym_3.25-5+deb13u2_i386.deb
 b44fab36339c283fee638f97df90050e 153416 python optional python3-gps_3.25-5+deb13u2_i386.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEBDWXQb2umOtH4DRpYg9P9sm2dfEFAmpmL58ACgkQYg9P9sm2
dfFP5BAAg4v5V6HyHlP4rkn2HgJCBwMIiLAvjAERPc3e40saDtcnFIQKTCnwKtNi
btY5osHEjFng0Uc3wHo18wrNLeUpbsRO/EgFqF1H1bFhM9X9WjvlUo5inq0lZhKU
0A2MG/3THidnm4ErcROOBXuCb2FVFehNVXdO3KtjxgZJdn2M+z24y+yuQgdth95m
F6oS8EnXE9MKYvzYENve/mLmcSp+3XFizUTLnt4BJQh7zlAYEPxnmTF8PgulVkeZ
sgtImEp7n1tyP1ONsaJzKubHs3zUswkPz0tckjrJ/EGdzL2txsin6kGaeDscUXiD
+S79VElvb00pyuKWBrhpk54IsPiSkpbOOEnEtRGoV+Q/iJ0JdLdhIvItHZqqAkF5
7qmH6sHVVq2sN7CLl8Ynquaayv6FM9IQP3INsRJ92oxuTgUfIylHU3Gr6sKuOyx6
a58tyDaHKdxGBqtTRGtN3iuXeAtyH7HHX1xOh0JKXKBnW4rbdrA7vQUQp0dVPkv4
/tzGqnu6z+iisDiaxPBL1bcZLnB2yS2w65eMimyHM7UMqHBlcjp4YN/eEtA7921x
LBmNnrD3f1PrqNOrGu+8/h/I8T6MzZxn0LLHTM7Co/r3pDlnCitpRHKSifOqhpLH
R4hXFobft3UtCIqOPFpS7SagEQQoLZlp7ExTZyV/vRCjDD5xgDI=
=UR5Z
-----END PGP SIGNATURE-----