-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 25 Jul 2026 21:40:31 +0000
Source: gpsd
Binary: gpsd gpsd-clients gpsd-clients-dbgsym gpsd-dbgsym gpsd-tools gpsd-tools-dbgsym libgps-dev libgps30t64 libgps30t64-dbgsym libqgpsmm-dev libqgpsmm30t64 libqgpsmm30t64-dbgsym python3-gps python3-gps-dbgsym
Architecture: armel
Version: 3.25-5+deb13u2
Distribution: trixie
Urgency: medium
Maintainer: armel Build Daemon (arm-ubc-03) <buildd_arm64-arm-ubc-03@buildd.debian.org>
Changed-By: Boian Bonev <bbonev@ipacct.com>
Description:
 gpsd       - Global Positioning System - daemon
 gpsd-clients - Global Positioning System - clients
 gpsd-tools - Global Positioning System - tools
 libgps-dev - Global Positioning System - development files
 libgps30t64 - Global Positioning System - library
 libqgpsmm-dev - Global Positioning System - Qt wrapper for libgps (development)
 libqgpsmm30t64 - Global Positioning System - Qt wrapper for libgps
 python3-gps - Global Positioning System - Python 3 libraries
Changes:
 gpsd (3.25-5+deb13u2) trixie; urgency=medium
 .
   * Fix CVE-2026-58459 (see #1141962). A command injection vulnerability
     exists in the gpsprof client. The subtype field, sourced from a
     DEVICES JSON log entry or an NMEA PGRMT sentence, is written into
     the generated gnuplot program via a set title statement with only
     double quote characters escaped. An attacker who controls the GPS
     device subtype can embed backtick payloads and execute arbitrary
     shell commands as the user running gnuplot when the generated plot
     is rendered.
   * Fix CVE-2026-60122. A code injection vulnerability exists in the
     gpsprof client. The SKY.satellites[].used field is inserted
     unsanitized into a gnuplot heredoc data block. An attacker who
     controls the GPS input data can supply a used value containing the
     string EOD to terminate the heredoc early and append gnuplot
     system() calls, achieving OS command execution as the user running
     gpsprof when the generated plot script is processed by gnuplot in
     polar mode.
Checksums-Sha1:
 b830d9f53b78a6c5bff07b2fd2f4dffd1455392c 1946532 gpsd-clients-dbgsym_3.25-5+deb13u2_armel.deb
 d097d7dbba87b4c221d253a609c1a705cb14e4c2 482548 gpsd-clients_3.25-5+deb13u2_armel.deb
 eb1a90d566f71ea698191c610885d70288dca4c7 2304304 gpsd-dbgsym_3.25-5+deb13u2_armel.deb
 4c477beffae9620cd7d1d1c55191088d755146e7 1580812 gpsd-tools-dbgsym_3.25-5+deb13u2_armel.deb
 8d84f7b2001dcf17a0dc06a0c2a8e6cb9fd271ed 329516 gpsd-tools_3.25-5+deb13u2_armel.deb
 dda5b3b580f090b6e765d5c2ccfb4f5bbb3f4b09 20850 gpsd_3.25-5+deb13u2_armel-buildd.buildinfo
 ba64cd73fb616d392f1140d4b499e53b144bd2a2 400200 gpsd_3.25-5+deb13u2_armel.deb
 d963fd8ed1f7d0c10c1a8f82dd7cec9b4084f261 144908 libgps-dev_3.25-5+deb13u2_armel.deb
 da84d05e7706305088891b71ad265a09a2ec44ba 167300 libgps30t64-dbgsym_3.25-5+deb13u2_armel.deb
 5744c7af6f9e67c2f24ca458c39bc9da034ccbab 84712 libgps30t64_3.25-5+deb13u2_armel.deb
 4cd71de5f1832002a0c4b1ba1a9f2fb0c95b870a 34600 libqgpsmm-dev_3.25-5+deb13u2_armel.deb
 9858903b01d1aab05570f2a013201f3b2b99b7cc 398572 libqgpsmm30t64-dbgsym_3.25-5+deb13u2_armel.deb
 18bac8745369225730bbe06772f9c831dfa126a1 86256 libqgpsmm30t64_3.25-5+deb13u2_armel.deb
 4fdbc3350d739cccb89700fa725e6dd8d2229fef 62548 python3-gps-dbgsym_3.25-5+deb13u2_armel.deb
 c8997cdc956adce1949ad874175a4bd54c8994dd 151204 python3-gps_3.25-5+deb13u2_armel.deb
Checksums-Sha256:
 72a89d16946bb4a36181787e8cf03a87f13edd198aa0bf1177285da0d4b6b46d 1946532 gpsd-clients-dbgsym_3.25-5+deb13u2_armel.deb
 90536733d33dd0fc2623ebaab6e6b4c9a75ddf7150ead01aea6d7aab58d3f640 482548 gpsd-clients_3.25-5+deb13u2_armel.deb
 2c0f7af986f37eca0d7ad9fd6088310e1f28b3d59fb0876cdf355bd6b04e64d9 2304304 gpsd-dbgsym_3.25-5+deb13u2_armel.deb
 ff44f90773418e16f503690efe1135fab196d2c082e71ef6cd91a0f749595f5c 1580812 gpsd-tools-dbgsym_3.25-5+deb13u2_armel.deb
 4c43110fd1f73f750af7e3c444b07876e7bf9fe1151bb9ceea11e77dc8d97b75 329516 gpsd-tools_3.25-5+deb13u2_armel.deb
 1f4809180abe869a64c20608157253cadb78f382eaee6b99beb17f47eb14369d 20850 gpsd_3.25-5+deb13u2_armel-buildd.buildinfo
 4a050db7582399e38ef5a975c897a44adec43c250044803401666ee435849df3 400200 gpsd_3.25-5+deb13u2_armel.deb
 915d098c4fdbf8c3368e41ac50c8a06d7e2165cc69bc0f7c98073f683628df85 144908 libgps-dev_3.25-5+deb13u2_armel.deb
 190aa99c6832675f8dea13387e418902a695c15f9a7759f05cfccd89049e3653 167300 libgps30t64-dbgsym_3.25-5+deb13u2_armel.deb
 789fdd95c90878d8bae71161b9d880015bc5cf65b125f60aabbb1a21d5a868b0 84712 libgps30t64_3.25-5+deb13u2_armel.deb
 ae2c1466eef0fa3b2f4918014052166bcfa3691e7066fec3d46df78b1cd8ed9e 34600 libqgpsmm-dev_3.25-5+deb13u2_armel.deb
 bc5c1d4e58b0ed260ee871ad6cd07d20f73dc099804c0666777bed8799d220fc 398572 libqgpsmm30t64-dbgsym_3.25-5+deb13u2_armel.deb
 5e50bc91cb0b53d82476c7e3c12dc37e9f5b1b0e7eb0f60e5de530f4f948fa5b 86256 libqgpsmm30t64_3.25-5+deb13u2_armel.deb
 6588229aa7a5729088d30a05f7680c45587507892fd7c8ecbd5eb77f9ae303f8 62548 python3-gps-dbgsym_3.25-5+deb13u2_armel.deb
 8970e7ec1b7e3ee82df8bcc470d60b12a38956c6af7644d8f1a988cf1cdabe36 151204 python3-gps_3.25-5+deb13u2_armel.deb
Files:
 b94bf86ead8858750669c0e17113c355 1946532 debug optional gpsd-clients-dbgsym_3.25-5+deb13u2_armel.deb
 3a2c11437f9ba04963ebee8863c0e447 482548 misc optional gpsd-clients_3.25-5+deb13u2_armel.deb
 b110d4ff8075ff4c8b4d555d99c16212 2304304 debug optional gpsd-dbgsym_3.25-5+deb13u2_armel.deb
 38f3af4e01a98c40d3d210337f6abe02 1580812 debug optional gpsd-tools-dbgsym_3.25-5+deb13u2_armel.deb
 b5dd79cefcebab84079cdc583d166fcd 329516 misc optional gpsd-tools_3.25-5+deb13u2_armel.deb
 aee4007093bd9f0bd3062ded1aa409bd 20850 misc optional gpsd_3.25-5+deb13u2_armel-buildd.buildinfo
 11e2a630f9b033010283fd78cc792b57 400200 misc optional gpsd_3.25-5+deb13u2_armel.deb
 abe851d1d0eef47f090c93c8b05e27a1 144908 libdevel optional libgps-dev_3.25-5+deb13u2_armel.deb
 26c195c46f3ceeca5113d3b79081e0f7 167300 debug optional libgps30t64-dbgsym_3.25-5+deb13u2_armel.deb
 eaffde2a3404ec62739b6a4149da2be3 84712 libs optional libgps30t64_3.25-5+deb13u2_armel.deb
 490a83510ee943d439cef13e78f75914 34600 libdevel optional libqgpsmm-dev_3.25-5+deb13u2_armel.deb
 70a3d6aa1fa405b84dd3fff816e0d47e 398572 debug optional libqgpsmm30t64-dbgsym_3.25-5+deb13u2_armel.deb
 129ecb662f6ac23fad39368b47f342e3 86256 libs optional libqgpsmm30t64_3.25-5+deb13u2_armel.deb
 9cc0aca3633a50f847b8789941eea5f0 62548 debug optional python3-gps-dbgsym_3.25-5+deb13u2_armel.deb
 a7b0c1c7d4ed5bdea4e980d61cdc868d 151204 python optional python3-gps_3.25-5+deb13u2_armel.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE2kd8oHy+LXk/nybqvzDqKQSGl8UFAmpmL88ACgkQvzDqKQSG
l8UrAA//cmp0av9BZ+ZhDz50IcBRff6Lo5w/orMXEChzxdDmrmAbxSu91jlo/9f8
+5WpOoTEY0bA5aElYUkgaf6wb3qzza8rwz0cgfgVI556D+Z4VHJ2VwHYtllWLKHX
pod/WuJKxfXkieP6fVxM9pkEz1ujVHlzPx9qx1HtfQHZ5+kLH04LdRzyWkN4RpZX
hEfuesQBT4cL/d2e1B+Pi5/V1I/bAol3lLQOq+r7YjsvIxz6yMfB4eWAg9sJHQmo
xC1dLnDduqzdqmJPvSXqe28RUUohg3z9F1mjlX+H3bqI1/iugERTdqepTpDlIKGb
JaLryafD17VCKud9svid51h9V4g+gp8AfcrHCfROFN31BDw9PSy07o0vPLitesdq
defr9IRHPURpjN/N2O7ReL7N1bYPXOPWuuIO/6H2ZllGtCh6YNW98Hd0fMMA2zcx
+tqNlipoCEPLvE8ZpUM5VejFEUyWwTaFsT2xZTunOtbCrUk4xFUU2JT5B9zL2gAF
INbKiLAxYqq0Uo6P8iDbW1Y1vgptEEoRazAf6AYkHZU6imgF25AWeEiY5fCt7P1z
L0C4dXM6lqfTbRDRTZDL39Yg7buKYgcEedDfVKRKeszR4VzdaD6ZVIhSjRaNasoi
Qc7vZrvFUnxhe1fDfjvB4kcpA7Iu4st1keOmBVjPErAy/to8a5Y=
=u2Js
-----END PGP SIGNATURE-----