From foo@bar  Sun Jul 26 00:30:02 2026
Format: 1.8
Date: Sat, 25 Jul 2026 21:16:01 +0000
Source: gpsd
Binary: gpsd gpsd-clients gpsd-clients-dbgsym gpsd-dbgsym gpsd-tools gpsd-tools-dbgsym libgps-dev libgps32 libgps32-dbgsym libqgpsmm-dev libqgpsmm32 libqgpsmm32-dbgsym python3-gps python3-gps-dbgsym
Architecture: alpha
Version: 3.27.5-1
Distribution: sid
Urgency: medium
Maintainer: alpha Build Daemon (alpha-sc-03) <alpha-sc-03@alpha-sc-03.buildd.org>
Changed-By: Boian Bonev <bbonev@ipacct.com>
Description:
 gpsd       - Global Positioning System - daemon
 gpsd-clients - Global Positioning System - clients
 gpsd-tools - Global Positioning System - tools
 libgps-dev - Global Positioning System - development files
 libgps32   - Global Positioning System - library
 libqgpsmm-dev - Global Positioning System - Qt wrapper for libgps (development)
 libqgpsmm32 - Global Positioning System - Qt wrapper for libgps
 python3-gps - Global Positioning System - Python 3 libraries
Closes: 1141962
Changes:
 gpsd (3.27.5-1) unstable; urgency=medium
 .
   * Fix CVE-2026-58459 (Closes: #1141962). A command injection
     vulnerability exists in the gpsprof client. The subtype field,
     sourced from a DEVICES JSON log entry or an NMEA PGRMT sentence, is
     written into the generated gnuplot program via a set title statement
     with only double quote characters escaped. An attacker who controls
     the GPS device subtype can embed backtick payloads and execute
     arbitrary shell commands as the user running gnuplot when the
     generated plot is rendered.
   * Fix CVE-2026-60122. A code injection vulnerability exists in the
     gpsprof client. The SKY.satellites[].used field is inserted
     unsanitized into a gnuplot heredoc data block. An attacker who
     controls the GPS input data can supply a used value containing the
     string EOD to terminate the heredoc early and append gnuplot
     system() calls, achieving OS command execution as the user running
     gpsprof when the generated plot script is processed by gnuplot in
     polar mode.
   * Bump standards to 4.7.4, no changes
   * Bump dh to 14
   * Remove redundant prio
Checksums-Sha1:
 18db368c33eb1e7e0152f4b11fe7b928785b9740 2219100 gpsd-clients-dbgsym_3.27.5-1_alpha.deb
 e3533cedf2cc47047c1e1390f73ad3c21b9a8195 572120 gpsd-clients_3.27.5-1_alpha.deb
 300e2fb561b0a761d5d105edadccb52ee53425fe 2654156 gpsd-dbgsym_3.27.5-1_alpha.deb
 64feea5acf1f06add0c71ec849cb696b7cb8612d 1797136 gpsd-tools-dbgsym_3.27.5-1_alpha.deb
 f2be46f47d4339bc735e079bc58e10b27b44eb85 400564 gpsd-tools_3.27.5-1_alpha.deb
 0b5989be42c316600f8da534e09dc52a0032010b 19971 gpsd_3.27.5-1_alpha.buildinfo
 d783b568da97947eee060755174f2a4e09508f75 482712 gpsd_3.27.5-1_alpha.deb
 d195bdd6918f2d00f7cb1bc0230f3f973267a78f 160568 libgps-dev_3.27.5-1_alpha.deb
 254a452816ac775df770ce5d74566b8b44534a99 189776 libgps32-dbgsym_3.27.5-1_alpha.deb
 092a555909c6c83bb5ca38d6ee830cff20d8dda3 90008 libgps32_3.27.5-1_alpha.deb
 c903c89072ff59c8acf493e067948f7a3f22f453 30000 libqgpsmm-dev_3.27.5-1_alpha.deb
 bb55663ecca37e42bf1c89d92db694d5269518b7 414136 libqgpsmm32-dbgsym_3.27.5-1_alpha.deb
 1e412feb56d33e1eb48138129a0ed33503396843 91968 libqgpsmm32_3.27.5-1_alpha.deb
 d92fc142321e72e7197d6150c8a90f174caa1e56 105420 python3-gps-dbgsym_3.27.5-1_alpha.deb
 471f894475fd8eb214dcde07ff7c195d6d161fbc 170476 python3-gps_3.27.5-1_alpha.deb
Checksums-Sha256:
 f317ab6c2c7e03787de168357c39be24314f1f4b8aeae5eaa1f60ee3174e182c 2219100 gpsd-clients-dbgsym_3.27.5-1_alpha.deb
 d599c655626bba7e05def8a7af36248177d2eb92bc82f5a21b7f26ff5b195474 572120 gpsd-clients_3.27.5-1_alpha.deb
 2369fbbba1363d0ee4ddbc3636eff69b9750cc500d2d13c2c508acf593901304 2654156 gpsd-dbgsym_3.27.5-1_alpha.deb
 19deab23e841aa63c1910f514d02d0f67380e2a79fd2d46199442c3b653039ee 1797136 gpsd-tools-dbgsym_3.27.5-1_alpha.deb
 0427ee1eecdbeb8b543b3b69b8a076e8dc262a858fb62472ad9e2af0abef7b20 400564 gpsd-tools_3.27.5-1_alpha.deb
 7e2863e3df28e50bae3d131001fc0558f9e9118bcf298ee1bbd66a27f685d53f 19971 gpsd_3.27.5-1_alpha.buildinfo
 ab1e0b4ac08f244a99e7072eeafde5e1fa7c17e0188f90a6ef2e3a99b8723b25 482712 gpsd_3.27.5-1_alpha.deb
 f6f35bb8a7503bca0f52dcc0d5fc8fb48329f01a60c7737ab3fb3e69d5db5fa3 160568 libgps-dev_3.27.5-1_alpha.deb
 fb5d25641c2a022e3e36a4624e1ceea0b68a626e5f440b3ae195f2eaa18a8561 189776 libgps32-dbgsym_3.27.5-1_alpha.deb
 e10aadfc72acb5f4146c663f3fca0f7d949a222f30acb437934dc3db6b902f2b 90008 libgps32_3.27.5-1_alpha.deb
 238d9f3a6a116e7e4d555f2d37898c2e440e671fb30b11fdfc11f56ce106a1b2 30000 libqgpsmm-dev_3.27.5-1_alpha.deb
 ae9fffbc825cd86d7342d283efa92f14a6b3f8016e6035b56aafb60c047df1e9 414136 libqgpsmm32-dbgsym_3.27.5-1_alpha.deb
 996436134318964bb9058542b51942e50426d0851838b0f2e658199f5fa2dc1a 91968 libqgpsmm32_3.27.5-1_alpha.deb
 910c571030d17c11bff1384e7c7b19d79353c6e1b91c5b53faa1df0d48703527 105420 python3-gps-dbgsym_3.27.5-1_alpha.deb
 0e72a771d36f8a8160f76ce32c0130693c41ffadde8a96b4a3ef4da663da2782 170476 python3-gps_3.27.5-1_alpha.deb
Files:
 88537c19cc43a3755c9cdce52245826d 2219100 debug optional gpsd-clients-dbgsym_3.27.5-1_alpha.deb
 8cea6295293b557141973dec5c7874e6 572120 misc optional gpsd-clients_3.27.5-1_alpha.deb
 705be73ffc0c9030c8962ccf92f5cf5d 2654156 debug optional gpsd-dbgsym_3.27.5-1_alpha.deb
 52f79c491f7ff34271381c16a33159c8 1797136 debug optional gpsd-tools-dbgsym_3.27.5-1_alpha.deb
 2c93fd6e58ec3990537db551b307d13e 400564 misc optional gpsd-tools_3.27.5-1_alpha.deb
 56926f4b9c5b73618845a3d9db822857 19971 misc optional gpsd_3.27.5-1_alpha.buildinfo
 49699f6242cbe4a1e810c121091ff07a 482712 misc optional gpsd_3.27.5-1_alpha.deb
 2b1461c0fbba1063f8b4f6da68bf4579 160568 libdevel optional libgps-dev_3.27.5-1_alpha.deb
 394fd9863acd66ba4e0e6d4417ef0cb4 189776 debug optional libgps32-dbgsym_3.27.5-1_alpha.deb
 b3cdebf6a88bb42d906a13f1c1808bc0 90008 libs optional libgps32_3.27.5-1_alpha.deb
 c8d9bf03eccdb19b911320c15ed6b703 30000 libdevel optional libqgpsmm-dev_3.27.5-1_alpha.deb
 26cbacd8c49e28b0660bd9107f9d89cf 414136 debug optional libqgpsmm32-dbgsym_3.27.5-1_alpha.deb
 442584abcde0e3fce84674f03e5f45a2 91968 libs optional libqgpsmm32_3.27.5-1_alpha.deb
 c7ce6daef18d31730d8417324fdaa7b4 105420 debug optional python3-gps-dbgsym_3.27.5-1_alpha.deb
 fb0f41d7f5ec03e4f3ed38b512437162 170476 python optional python3-gps_3.27.5-1_alpha.deb
Signed-By: Debian buildd autosigning key for alpha-sc-03 <buildd_alpha-alpha-sc-03@buildd.debian.org>