-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 25 Jul 2026 21:40:31 +0000
Source: gpsd
Binary: gpsd gpsd-clients gpsd-clients-dbgsym gpsd-dbgsym gpsd-tools gpsd-tools-dbgsym libgps-dev libgps30t64 libgps30t64-dbgsym libqgpsmm-dev libqgpsmm30t64 libqgpsmm30t64-dbgsym python3-gps python3-gps-dbgsym
Architecture: armhf
Version: 3.25-5+deb13u2
Distribution: trixie
Urgency: medium
Maintainer: armhf Build Daemon (arm-ubc-02) <buildd_arm64-arm-ubc-02@buildd.debian.org>
Changed-By: Boian Bonev <bbonev@ipacct.com>
Description:
 gpsd       - Global Positioning System - daemon
 gpsd-clients - Global Positioning System - clients
 gpsd-tools - Global Positioning System - tools
 libgps-dev - Global Positioning System - development files
 libgps30t64 - Global Positioning System - library
 libqgpsmm-dev - Global Positioning System - Qt wrapper for libgps (development)
 libqgpsmm30t64 - Global Positioning System - Qt wrapper for libgps
 python3-gps - Global Positioning System - Python 3 libraries
Changes:
 gpsd (3.25-5+deb13u2) trixie; urgency=medium
 .
   * Fix CVE-2026-58459 (see #1141962). A command injection vulnerability
     exists in the gpsprof client. The subtype field, sourced from a
     DEVICES JSON log entry or an NMEA PGRMT sentence, is written into
     the generated gnuplot program via a set title statement with only
     double quote characters escaped. An attacker who controls the GPS
     device subtype can embed backtick payloads and execute arbitrary
     shell commands as the user running gnuplot when the generated plot
     is rendered.
   * Fix CVE-2026-60122. A code injection vulnerability exists in the
     gpsprof client. The SKY.satellites[].used field is inserted
     unsanitized into a gnuplot heredoc data block. An attacker who
     controls the GPS input data can supply a used value containing the
     string EOD to terminate the heredoc early and append gnuplot
     system() calls, achieving OS command execution as the user running
     gpsprof when the generated plot script is processed by gnuplot in
     polar mode.
Checksums-Sha1:
 3acec95bceec24804160e772bc70fe6e74551a47 1930632 gpsd-clients-dbgsym_3.25-5+deb13u2_armhf.deb
 ddf1c2ab741982c81b0c4122c93a0f9302c4d434 471036 gpsd-clients_3.25-5+deb13u2_armhf.deb
 2f7e683a92876f27556df18f15dee7b839b072b2 2301624 gpsd-dbgsym_3.25-5+deb13u2_armhf.deb
 393aabac9f0359186cda87ea078fad24f9453096 1575964 gpsd-tools-dbgsym_3.25-5+deb13u2_armhf.deb
 fa7271cc701880e44d5c2beec06e36b51b77f8ab 316172 gpsd-tools_3.25-5+deb13u2_armhf.deb
 fddc467d9056b1516366548d696142ccadb72266 20864 gpsd_3.25-5+deb13u2_armhf-buildd.buildinfo
 4059208d317b542c372ca7f38bb99d1ef8b9f60b 386680 gpsd_3.25-5+deb13u2_armhf.deb
 7a6075e9e810da76f12d18828347b7b46ab0c603 141948 libgps-dev_3.25-5+deb13u2_armhf.deb
 b4c89f81056b0df81e489219c23553de56f71603 167804 libgps30t64-dbgsym_3.25-5+deb13u2_armhf.deb
 08af5e95f8d7bce9bf71d566a9ac26cf9fba425b 81644 libgps30t64_3.25-5+deb13u2_armhf.deb
 1ad2c44e9a8b7fb17750ae1e035e7366322c11de 34592 libqgpsmm-dev_3.25-5+deb13u2_armhf.deb
 ca9d1edef509272daf937621b7965a09c02bfaf2 398812 libqgpsmm30t64-dbgsym_3.25-5+deb13u2_armhf.deb
 a37a4cfcc9f1c53aa59b47d1782dc9b3aed3b0fd 83804 libqgpsmm30t64_3.25-5+deb13u2_armhf.deb
 8f4d9f63540eca7b67a9507c8ab84d855803e2b9 63340 python3-gps-dbgsym_3.25-5+deb13u2_armhf.deb
 1bb3bee2f5cf62d02c611905ecf687b2f2f56a50 150884 python3-gps_3.25-5+deb13u2_armhf.deb
Checksums-Sha256:
 d18f06887b5d9724e3fa12aad1f2aef132646f89d386bc358cc3378f1e1857c6 1930632 gpsd-clients-dbgsym_3.25-5+deb13u2_armhf.deb
 90094799357eef940486b125742755f83f3d1c26acdb7f8feb6d4206186fa609 471036 gpsd-clients_3.25-5+deb13u2_armhf.deb
 ccc644ee8f67565a17bded4e94dfda1547ac7aa93881c0aebbb51c1ee1c605f1 2301624 gpsd-dbgsym_3.25-5+deb13u2_armhf.deb
 7ebf55f36826965bb38e6d1069eca3dcfda34fbc71c30d69ffae7c61a6a3e43a 1575964 gpsd-tools-dbgsym_3.25-5+deb13u2_armhf.deb
 0e5dfc14d9a10b9016bd59cfab04fd548f844d355da3d949a4379f19582d3d4c 316172 gpsd-tools_3.25-5+deb13u2_armhf.deb
 e90fd15c7b462212cacb27e8765865aa2e4a929ed55f798cbd298ec59138d73a 20864 gpsd_3.25-5+deb13u2_armhf-buildd.buildinfo
 308a0ad35155bd45dbb8bbc5bf466ef507b29440e99cec251e93ca8b432aa679 386680 gpsd_3.25-5+deb13u2_armhf.deb
 90522bdb9e019db1b9d6398dcecae0d0830e79d9a0f05317699ec238e83a5788 141948 libgps-dev_3.25-5+deb13u2_armhf.deb
 50d0a92e7c41742e104f11b2dd3a88649d926565c4f983575e3a636fbaa89a11 167804 libgps30t64-dbgsym_3.25-5+deb13u2_armhf.deb
 671e6591f7867d936f63d89de71e5107c9e7870667be9fdb26d00d8414849410 81644 libgps30t64_3.25-5+deb13u2_armhf.deb
 1ee0849205cb5d567adc71af56d156b79a0599891f501e5ace23cf527df9c9a8 34592 libqgpsmm-dev_3.25-5+deb13u2_armhf.deb
 dbf64eb22dc0aea9828cac87902accda2fb187b7357962240dd56ec247ed069e 398812 libqgpsmm30t64-dbgsym_3.25-5+deb13u2_armhf.deb
 d71ccd14c5cb9ac95379c7ef6f2c9125d9326f3ce8adb99eae795963ac33f7e2 83804 libqgpsmm30t64_3.25-5+deb13u2_armhf.deb
 33a9816e0a5006944eae16d6233b44c46e66a961820d4d2c8e17ddf581659509 63340 python3-gps-dbgsym_3.25-5+deb13u2_armhf.deb
 7cf972070f9b185e1cde61380116eae46db4fb0217cf3c3d6ba75d931710cbe0 150884 python3-gps_3.25-5+deb13u2_armhf.deb
Files:
 6868897082cdd1998fea554ea75d39eb 1930632 debug optional gpsd-clients-dbgsym_3.25-5+deb13u2_armhf.deb
 633fa8f1d332f8f882a0e6432ed1acd4 471036 misc optional gpsd-clients_3.25-5+deb13u2_armhf.deb
 c7f7ccb4e02a14f0194ab31d6964747f 2301624 debug optional gpsd-dbgsym_3.25-5+deb13u2_armhf.deb
 b19bc065945e5bd19c2e15158a8535f0 1575964 debug optional gpsd-tools-dbgsym_3.25-5+deb13u2_armhf.deb
 79dd9c70c8640c8f2d298e1abbd2dc04 316172 misc optional gpsd-tools_3.25-5+deb13u2_armhf.deb
 c66d50a026c0c1c18eba13fc0208beeb 20864 misc optional gpsd_3.25-5+deb13u2_armhf-buildd.buildinfo
 9f57c45d46d3d60c54d8ef1ab9f69114 386680 misc optional gpsd_3.25-5+deb13u2_armhf.deb
 7e1d320b830a05d1fcc19f28a7d577cd 141948 libdevel optional libgps-dev_3.25-5+deb13u2_armhf.deb
 9ea4aafc3144c3438f6d16ab9e4f740e 167804 debug optional libgps30t64-dbgsym_3.25-5+deb13u2_armhf.deb
 913409352f670e935d9ea98ebd841a9e 81644 libs optional libgps30t64_3.25-5+deb13u2_armhf.deb
 4f11701c5fe0d0645cad8e9a4023cc09 34592 libdevel optional libqgpsmm-dev_3.25-5+deb13u2_armhf.deb
 faf76082e8614797eb090bf785dbb7d5 398812 debug optional libqgpsmm30t64-dbgsym_3.25-5+deb13u2_armhf.deb
 5015e8eecdc33ab5406cfab5494655ac 83804 libs optional libqgpsmm30t64_3.25-5+deb13u2_armhf.deb
 059c3adbc7b3a0f00b7c749c5d7ef39f 63340 debug optional python3-gps-dbgsym_3.25-5+deb13u2_armhf.deb
 4a4575b206ee7add31bd3963926c024a 150884 python optional python3-gps_3.25-5+deb13u2_armhf.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEJkN0BnKzGWWW6tS+G5VHrWJmwgcFAmpmL74ACgkQG5VHrWJm
wgehqRAAqOUwNSehrFC1DqsraqEKxO6DYGVcwCt27pvM8GuUN7MqMX42Fg7yUbAT
xnig2kt3WBKUOsoMv092jZWhOcFm/eyJXP39ealI4jdbr2KkZhIKdA46/i/CjnTh
d750Ru4e84Sp76TJPaVslrV+u64Q8YOU3CkIIGvs089Ius23lT2n2Fxzx7EwqpYs
FmqUkrxXNDoY2u2BKKXQxG6UqwzaH63JfQTsPfkG97uz9Te1/02in00Syxa+bDFR
4age9qPZy35mnNxFfSh7XMdkLRD7rNwWvywkLEpfHNmxfrqlTH6VPXgqe8a46vDV
pkwJljYWuNdaRKALBCrHcCA4kW5yF/lK/SfxECNw85LF7gWa2naVg/eDuVS/ke0l
g3mCF/fq5+sVlQkaA2LduslqjdZ2AmxiilFUIK/hmXvTrsI3LmkSN927w4I0Q6+a
p41EwcDn8c6p7S8x8gT6kC7Bz1y1vfhGvhtqVV0DfwRWjRgJymBkFqgmdv08swNq
jNqjxLeoKUD6Pm5L3+oUyyiKO81U06mVA/MuXs14jv0z0VOkropmeO/KfXeUIZm/
LFZeSwj3WdBcn6oxXP9ueLrUz5yiJHmRy176S8ljppE6AcPEI0TXFTI/rwajhIIc
cKR4gIpuIiNmsUijNzI75KkGP4319PM02Qj0jG6HPO8NxCdAuSE=
=P545
-----END PGP SIGNATURE-----