From foo@bar Sun Jul 26 00:30:02 2026 Format: 1.8 Date: Sat, 25 Jul 2026 21:16:01 +0000 Source: gpsd Binary: gpsd gpsd-clients gpsd-clients-dbgsym gpsd-dbgsym gpsd-tools gpsd-tools-dbgsym libgps-dev libgps32 libgps32-dbgsym libqgpsmm-dev libqgpsmm32 libqgpsmm32-dbgsym python3-gps python3-gps-dbgsym Architecture: hppa Version: 3.27.5-1 Distribution: sid Urgency: medium Maintainer: hppa Build Daemon (pasta) Changed-By: Boian Bonev Description: gpsd - Global Positioning System - daemon gpsd-clients - Global Positioning System - clients gpsd-tools - Global Positioning System - tools libgps-dev - Global Positioning System - development files libgps32 - Global Positioning System - library libqgpsmm-dev - Global Positioning System - Qt wrapper for libgps (development) libqgpsmm32 - Global Positioning System - Qt wrapper for libgps python3-gps - Global Positioning System - Python 3 libraries Closes: 1141962 Changes: gpsd (3.27.5-1) unstable; urgency=medium . * Fix CVE-2026-58459 (Closes: #1141962). A command injection vulnerability exists in the gpsprof client. The subtype field, sourced from a DEVICES JSON log entry or an NMEA PGRMT sentence, is written into the generated gnuplot program via a set title statement with only double quote characters escaped. An attacker who controls the GPS device subtype can embed backtick payloads and execute arbitrary shell commands as the user running gnuplot when the generated plot is rendered. * Fix CVE-2026-60122. A code injection vulnerability exists in the gpsprof client. The SKY.satellites[].used field is inserted unsanitized into a gnuplot heredoc data block. An attacker who controls the GPS input data can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode. * Bump standards to 4.7.4, no changes * Bump dh to 14 * Remove redundant prio Checksums-Sha1: e9e63ec3c160e40e5d949da3d2b3b0f9a246ac88 2137756 gpsd-clients-dbgsym_3.27.5-1_hppa.deb 08f8f3bb6ec0e5181a08592d860b84d05885115b 579876 gpsd-clients_3.27.5-1_hppa.deb c4ab0476889715e5526a815f455105be511309c3 2651904 gpsd-dbgsym_3.27.5-1_hppa.deb 464aa096df2d34ffade36d448a733ff2dd3d4f32 1770812 gpsd-tools-dbgsym_3.27.5-1_hppa.deb 36c0218367ac3eb7c93a22f21f423cf0944e143a 409416 gpsd-tools_3.27.5-1_hppa.deb af58ffc7d5f72afb358d42f24a7a03d449200be7 19818 gpsd_3.27.5-1_hppa.buildinfo 65576a150b06ace6d444ae1bc3a584d5d262959f 491144 gpsd_3.27.5-1_hppa.deb 96b6ad51a1b3b2a0530177c52b111a8d969f3a4b 158048 libgps-dev_3.27.5-1_hppa.deb f5411bb0e3780db0cfd44c3c032c3091b6931fdd 174444 libgps32-dbgsym_3.27.5-1_hppa.deb b1cb8f21fa725902516aa942922b27c311029c34 89840 libgps32_3.27.5-1_hppa.deb 3c254f17a9239b5993c789dbc00ac1c050dedded 30012 libqgpsmm-dev_3.27.5-1_hppa.deb 089a06eeadc1c640cf00585cf46e71339135a833 407916 libqgpsmm32-dbgsym_3.27.5-1_hppa.deb 91bd19f23a66dcaaad267c33d7c829db1b27d647 94320 libqgpsmm32_3.27.5-1_hppa.deb 082472b4d2f80ce83a90c2ba80f4d0d475d2a51d 108016 python3-gps-dbgsym_3.27.5-1_hppa.deb 662c160ba708ab898a50374d721cbd14274533d1 171224 python3-gps_3.27.5-1_hppa.deb Checksums-Sha256: 0e87e044a53bd2c89d93bd559ae0f4498336eadba77df654150279e270a16746 2137756 gpsd-clients-dbgsym_3.27.5-1_hppa.deb a4ee76d5b02fbc8fcbc78499f3b657c965b313c3c60a019afe17e4f9ce89d401 579876 gpsd-clients_3.27.5-1_hppa.deb cb53a7071008b3a6661b93fcab4f4ed468b6c5ada90c28b4aec54b4d96d4791c 2651904 gpsd-dbgsym_3.27.5-1_hppa.deb d5ea63b15fb56e466a0847c731de9a411543bdfeef239f3d2357b2bcd958f284 1770812 gpsd-tools-dbgsym_3.27.5-1_hppa.deb 757d3958967bcfd93f8e50f971049528b8dd1537d33f71638f2e9facd0323c1a 409416 gpsd-tools_3.27.5-1_hppa.deb b2693a9031aa1747289185633bcfd4c8112fc1b88679e9e28300d22b05a31e17 19818 gpsd_3.27.5-1_hppa.buildinfo f14de305778c51d7066b1e8d5a121ba37c579fb8b8dc2d8d2f92e74eece233aa 491144 gpsd_3.27.5-1_hppa.deb 8bf63a1885b2e32300b8e0bb195b7c5b63b4149b9239d2f2ad361077b4705654 158048 libgps-dev_3.27.5-1_hppa.deb 977626ef17626a10f436b5e2fe3d373eebfd4505525382bf1e946d0baff38c56 174444 libgps32-dbgsym_3.27.5-1_hppa.deb 0002db75b55b2f88a17c4f50000b64ea114738ef8910ffd4ad1c88054a0c1937 89840 libgps32_3.27.5-1_hppa.deb 9e092cd885840c098acf677cbcd93cebda56773865a8d909bf90000d092d7c9e 30012 libqgpsmm-dev_3.27.5-1_hppa.deb 1cbcd67cd096d01949c49495647d48489383861a0cb547711a4db0b4b7a6e308 407916 libqgpsmm32-dbgsym_3.27.5-1_hppa.deb 6c0788b13d54d3a8eb383668470c71cf6dcfadadb34bdddc678577141a14fee6 94320 libqgpsmm32_3.27.5-1_hppa.deb 51de7a113ee64ee4c3ab3991cd8a023a6eaf9cb10fc2b9c6057e23869456d23d 108016 python3-gps-dbgsym_3.27.5-1_hppa.deb ce83428dcea0927dd2983988bd3aacdcba2aac127184a79282cbf32072198cf7 171224 python3-gps_3.27.5-1_hppa.deb Files: 72d35786f0194a0b64c229792f59ae16 2137756 debug optional gpsd-clients-dbgsym_3.27.5-1_hppa.deb 23776dd0c8086d6136bccf27bcb055b8 579876 misc optional gpsd-clients_3.27.5-1_hppa.deb ea745d7571e06b8c2142cc51b263f916 2651904 debug optional gpsd-dbgsym_3.27.5-1_hppa.deb b86573e0d84dfb5720fb63d6f4606cc7 1770812 debug optional gpsd-tools-dbgsym_3.27.5-1_hppa.deb c8d22a583d7963bde3d87edd350071e3 409416 misc optional gpsd-tools_3.27.5-1_hppa.deb 7bbed18ff33b19bdf45430a9ac3cda28 19818 misc optional gpsd_3.27.5-1_hppa.buildinfo 45fa0bf4ff68cdf74d1c2e56b89d7707 491144 misc optional gpsd_3.27.5-1_hppa.deb 9e986e5015651a39869e4420864395f0 158048 libdevel optional libgps-dev_3.27.5-1_hppa.deb c4bf7a907002909b21c848ef2b148244 174444 debug optional libgps32-dbgsym_3.27.5-1_hppa.deb fdf1f16e4535819632b13db85f2c8d94 89840 libs optional libgps32_3.27.5-1_hppa.deb a7ab9f5f7032619d433ab0809b0de525 30012 libdevel optional libqgpsmm-dev_3.27.5-1_hppa.deb 28763328cd80e0b096567155f2ffdaf2 407916 debug optional libqgpsmm32-dbgsym_3.27.5-1_hppa.deb 0b284f2aacaab9281fe8b5d7cfd06cc6 94320 libs optional libqgpsmm32_3.27.5-1_hppa.deb 782b935b99b1021eab2133e32396771b 108016 debug optional python3-gps-dbgsym_3.27.5-1_hppa.deb 27abe32c8620e0c0d201634605912f86 171224 python optional python3-gps_3.27.5-1_hppa.deb Signed-By: Debian buildd autosigning key for pasta