From foo@bar Sun Jul 26 00:20:03 2026 Format: 1.8 Date: Sat, 25 Jul 2026 21:16:01 +0000 Source: gpsd Binary: gpsd gpsd-clients gpsd-clients-dbgsym gpsd-dbgsym gpsd-tools gpsd-tools-dbgsym libgps-dev libgps32 libgps32-dbgsym libqgpsmm-dev libqgpsmm32 libqgpsmm32-dbgsym python3-gps python3-gps-dbgsym Architecture: sparc64 Version: 3.27.5-1 Distribution: sid Urgency: medium Maintainer: sparc64 Build Daemon (sompek) Changed-By: Boian Bonev Description: gpsd - Global Positioning System - daemon gpsd-clients - Global Positioning System - clients gpsd-tools - Global Positioning System - tools libgps-dev - Global Positioning System - development files libgps32 - Global Positioning System - library libqgpsmm-dev - Global Positioning System - Qt wrapper for libgps (development) libqgpsmm32 - Global Positioning System - Qt wrapper for libgps python3-gps - Global Positioning System - Python 3 libraries Closes: 1141962 Changes: gpsd (3.27.5-1) unstable; urgency=medium . * Fix CVE-2026-58459 (Closes: #1141962). A command injection vulnerability exists in the gpsprof client. The subtype field, sourced from a DEVICES JSON log entry or an NMEA PGRMT sentence, is written into the generated gnuplot program via a set title statement with only double quote characters escaped. An attacker who controls the GPS device subtype can embed backtick payloads and execute arbitrary shell commands as the user running gnuplot when the generated plot is rendered. * Fix CVE-2026-60122. A code injection vulnerability exists in the gpsprof client. The SKY.satellites[].used field is inserted unsanitized into a gnuplot heredoc data block. An attacker who controls the GPS input data can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode. * Bump standards to 4.7.4, no changes * Bump dh to 14 * Remove redundant prio Checksums-Sha1: 785c64d890ea338626916904e5c289ace96a5329 2179888 gpsd-clients-dbgsym_3.27.5-1_sparc64.deb d3208b6bf629f7780efc774de1d911183f2b0013 524712 gpsd-clients_3.27.5-1_sparc64.deb 244b51aed9f6772818a6549a845a00c3b31cb57e 2649836 gpsd-dbgsym_3.27.5-1_sparc64.deb b9d3594bae4ccbc481473ca437c7af8069526355 1785044 gpsd-tools-dbgsym_3.27.5-1_sparc64.deb ef922eb6622daa7042d3b5c39535f944106a4de4 357260 gpsd-tools_3.27.5-1_sparc64.deb 085aae9ca6a991bd4170ea8ca8e22c96754c1570 20116 gpsd_3.27.5-1_sparc64.buildinfo 36a1dd6171df741c3e89ecf6091f9aeeb9002ca7 436400 gpsd_3.27.5-1_sparc64.deb 3c3cc79a4acaf0d654ae823b885a9d060a370a18 148612 libgps-dev_3.27.5-1_sparc64.deb 1aa56327790ed189f39c59496bfe38cdde024d77 182236 libgps32-dbgsym_3.27.5-1_sparc64.deb d3240145fa46d82d96b0e01f8b1ddb018daa1835 82392 libgps32_3.27.5-1_sparc64.deb 334b15d7dba4c007558d6e5bd15c0cea4ac05716 30024 libqgpsmm-dev_3.27.5-1_sparc64.deb 172422d363609f30c744738976c116466516945f 410024 libqgpsmm32-dbgsym_3.27.5-1_sparc64.deb bc32e641c7a951b4beebb15f710448ea3dc14fba 84636 libqgpsmm32_3.27.5-1_sparc64.deb 75c80fcde5ef58a80adff71a9d6436d09211ef53 105800 python3-gps-dbgsym_3.27.5-1_sparc64.deb ed47f7a0bb33a52cab265e1b0d37b7ce0d24d204 168960 python3-gps_3.27.5-1_sparc64.deb Checksums-Sha256: 2eb428013758817274edfdbb4efa9d5f17cf238dfc1c8c4cbfecc008a259502b 2179888 gpsd-clients-dbgsym_3.27.5-1_sparc64.deb 31b4df5ae31f425ddc2bd4e24f6a16b8da576b56eaf60d23c7cf459826355218 524712 gpsd-clients_3.27.5-1_sparc64.deb cff4b0ae9487c33c20bf33dd06a404d8f402786c8790e8336d02ec9740d02490 2649836 gpsd-dbgsym_3.27.5-1_sparc64.deb 9dca3b33e272a301ac7e77d9fbbe00e203ecf2660908578fbee0e2b9301cae76 1785044 gpsd-tools-dbgsym_3.27.5-1_sparc64.deb 041073db476d0ff514ebd02dc9922ebf14558be59f256023f6993faa9e234c64 357260 gpsd-tools_3.27.5-1_sparc64.deb 5bb71bc35ee2413738db648139611e672db88eba2674ad2991c599e894e586b3 20116 gpsd_3.27.5-1_sparc64.buildinfo 0ca334689caa9c5776cf3b1ef804437b462f718e8571739dd3c3f2ff114bb243 436400 gpsd_3.27.5-1_sparc64.deb e92baa16fd3b4b8d00425b19658fb710491d692bc55b6f4b5acaa01c26b074c5 148612 libgps-dev_3.27.5-1_sparc64.deb e6235ee27dfb75cec9899079e1c28d7e6fb394014d715576438c9f5031c61b8a 182236 libgps32-dbgsym_3.27.5-1_sparc64.deb 3ced6e66e0081f3c4dd154495bd23fb6b8ca6c1531bcf7207d0e133d06d5b1da 82392 libgps32_3.27.5-1_sparc64.deb 7921fe79de20463461b5ead8811146f3385315497365778d109d59933337d341 30024 libqgpsmm-dev_3.27.5-1_sparc64.deb 97dbc96cb914d91cef2212e60a6d471ef1c73c3bf273148dbc5112d622d5d9a6 410024 libqgpsmm32-dbgsym_3.27.5-1_sparc64.deb 50d0409f482ac5049a62babcb50ea33f8f32eee2e815f076027aecef34ef26b4 84636 libqgpsmm32_3.27.5-1_sparc64.deb bfa98c99ebeb70bcaa39fe0a8ba5a16d6783c937a23c9aca2e69bdedb00d08da 105800 python3-gps-dbgsym_3.27.5-1_sparc64.deb 62f8c9a733b0705b09357b4207db038ba00e3dac051d31a82c7d585d1770e059 168960 python3-gps_3.27.5-1_sparc64.deb Files: eb43fcfd1df2fd4679741faeb17c52b5 2179888 debug optional gpsd-clients-dbgsym_3.27.5-1_sparc64.deb b15607f6af22240c10b4e50f92ac6ae7 524712 misc optional gpsd-clients_3.27.5-1_sparc64.deb b38994d9b400f9f195721b66ae3e38ff 2649836 debug optional gpsd-dbgsym_3.27.5-1_sparc64.deb 650a21ce2de47e7f0fb49f1861012d6c 1785044 debug optional gpsd-tools-dbgsym_3.27.5-1_sparc64.deb 8493cbd2376e24e224c4ee9af8f4e147 357260 misc optional gpsd-tools_3.27.5-1_sparc64.deb 80582acf449addb4ed16d52a87ff3c90 20116 misc optional gpsd_3.27.5-1_sparc64.buildinfo 41811368e5c900940308230c1d310862 436400 misc optional gpsd_3.27.5-1_sparc64.deb a7fd00f47120004641e8c89ae314ec61 148612 libdevel optional libgps-dev_3.27.5-1_sparc64.deb f828f2329f2f31ffc9b55d1c53c02a72 182236 debug optional libgps32-dbgsym_3.27.5-1_sparc64.deb d3a6430e1aa4f8265c7236a011bc9274 82392 libs optional libgps32_3.27.5-1_sparc64.deb 9181d191e40663455489248122be9cca 30024 libdevel optional libqgpsmm-dev_3.27.5-1_sparc64.deb f8b7f64cc183da1ac530bb60c9e5e0cf 410024 debug optional libqgpsmm32-dbgsym_3.27.5-1_sparc64.deb 3025d7d5e13b67dbafd82cf18ce69d55 84636 libs optional libqgpsmm32_3.27.5-1_sparc64.deb 035b6be883cb35f8ce27888bfef28c9a 105800 debug optional python3-gps-dbgsym_3.27.5-1_sparc64.deb bc7b1d27a5ebcc33edd262c0833a4916 168960 python optional python3-gps_3.27.5-1_sparc64.deb Signed-By: Debian buildd autosigning key for sompek