Version in base suite: 3.25-5+deb13u1 Base version: gpsd_3.25-5+deb13u1 Target version: gpsd_3.25-5+deb13u2 Base file: /srv/ftp-master.debian.org/ftp/pool/main/g/gpsd/gpsd_3.25-5+deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/g/gpsd/gpsd_3.25-5+deb13u2.dsc changelog | 21 ++++++++++++ patches/CVE-2026-58459.patch | 73 +++++++++++++++++++++++++++++++++++++++++++ patches/CVE-2026-60122.patch | 50 +++++++++++++++++++++++++++++ patches/series | 2 + 4 files changed, 146 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpxt25sekw/gpsd_3.25-5+deb13u1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpxt25sekw/gpsd_3.25-5+deb13u2.dsc: no acceptable signature found diff -Nru gpsd-3.25/debian/changelog gpsd-3.25/debian/changelog --- gpsd-3.25/debian/changelog 2026-01-17 16:51:45.000000000 +0000 +++ gpsd-3.25/debian/changelog 2026-07-25 21:40:31.000000000 +0000 @@ -1,3 +1,24 @@ +gpsd (3.25-5+deb13u2) trixie; urgency=medium + + * Fix CVE-2026-58459 (see #1141962). A command injection vulnerability + exists in the gpsprof client. The subtype field, sourced from a + DEVICES JSON log entry or an NMEA PGRMT sentence, is written into + the generated gnuplot program via a set title statement with only + double quote characters escaped. An attacker who controls the GPS + device subtype can embed backtick payloads and execute arbitrary + shell commands as the user running gnuplot when the generated plot + is rendered. + * Fix CVE-2026-60122. A code injection vulnerability exists in the + gpsprof client. The SKY.satellites[].used field is inserted + unsanitized into a gnuplot heredoc data block. An attacker who + controls the GPS input data can supply a used value containing the + string EOD to terminate the heredoc early and append gnuplot + system() calls, achieving OS command execution as the user running + gpsprof when the generated plot script is processed by gnuplot in + polar mode. + + -- Boian Bonev Sat, 25 Jul 2026 21:40:31 +0000 + gpsd (3.25-5+deb13u1) trixie; urgency=medium * Non-Maintainer Upload by LTS team diff -Nru gpsd-3.25/debian/patches/CVE-2026-58459.patch gpsd-3.25/debian/patches/CVE-2026-58459.patch --- gpsd-3.25/debian/patches/CVE-2026-58459.patch 1970-01-01 00:00:00.000000000 +0000 +++ gpsd-3.25/debian/patches/CVE-2026-58459.patch 2026-07-25 21:40:31.000000000 +0000 @@ -0,0 +1,73 @@ +From: Gary E. Miller +Subject: gpsprof: quote double quotes and back ticks in title and terminal + +gpsd through release-3.27.5 contains a command injection vulnerability in +gpsprof that allows attackers who control the GPS device subtype value to +execute arbitrary shell commands by embedding backtick payloads in the +gnuplot plot title without proper escaping. The subtype field, sourced +from a DEVICES JSON log entry or an NMEA PGRMT sentence, is written into +the generated gnuplot program via a "set title" statement with only double +quote characters escaped, enabling arbitrary shell command execution as the +user running gnuplot when the victim renders the generated plot through the +gpsprof and gnuplot workflow. + +Escape ", ` and newline in the plot description, in the title and in the +terminal name before writing them into the gnuplot program. + +This is the cumulative upstream fix, squashed from commits 5581ba19, +1a6bb7bc and 4c06658e; the middle commit had a typo that made the back tick +substitution a no-op, corrected by the last one. + +Backported to 3.25: line offsets only, the surrounding code is unchanged +between 3.25 and 3.27.5. + +Origin: upstream, https://gitlab.com/gpsd/gpsd/-/commit/5581ba196d826a984fbfaf792b7d58535f9911ce +Origin: upstream, https://gitlab.com/gpsd/gpsd/-/commit/1a6bb7bcbdf58aa940132e630870af061dc88537 +Origin: upstream, https://gitlab.com/gpsd/gpsd/-/commit/4c06658e988f4ced1a7a574ce082a22ef625df56 +Applied-Upstream: 4c06658e988f4ced1a7a574ce082a22ef625df56 +Bug: https://gitlab.com/gpsd/gpsd/-/work_items/404 +Bug-Debian: https://bugs.debian.org/1141962 +Last-Update: 2026-07-25 + +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -233,6 +233,11 @@ class plotter(object): + if 'subtype' in self.device: + desc += "\\n%s" % self.device['subtype'] + ++ # escape ", `, and \n, for gnuplot, to not break strings ++ desc = desc.replace('"', '\\042') ++ desc = desc.replace("\x60", '\\140') ++ desc = desc.replace('\n', '') ++ + return desc + + def collect(self, verb, log_fp=None): +@@ -1292,16 +1297,23 @@ if __name__ == '__main__': + # Ship the plot to standard output + if not options.title: + options.title = plot.whatami() +- # escape " for gnuplot +- options.title = options.title.replace('"', '\\"') + if options.subtitle: + options.title += '\\n' + options.subtitle ++ # escape ", and`, for gnuplot, to not break strings ++ options.title = options.title.replace('"', '\\042') ++ options.title = options.title.replace("\x60", '\\140') + term_opts = "" + truecolor_terms = ['png', 'sixelgd', 'wxt'] + if options.terminal in truecolor_terms: + term_opts = 'truecolor' +- sys.stdout.write("set terminal %s size 800,950 %s\n" +- "set termoption enhanced\n" ++ ++ # escape ", `, and \n, for gnuplot, to not break strings ++ options.terminal = options.terminal.replace('"', '\\042') ++ options.terminal = options.terminal.replace("\x60", '\\140') ++ options.terminal = options.terminal.replace('\n', '') ++ ++ sys.stdout.write('set terminal "%s" size 800,950 %s\n' ++ 'set termoption enhanced\n' + % (options.terminal, term_opts)) + # double quotes on title so \n is parsed by gnuplot + sys.stdout.write('set title noenhanced "%s\\n\\n"\n' % options.title) diff -Nru gpsd-3.25/debian/patches/CVE-2026-60122.patch gpsd-3.25/debian/patches/CVE-2026-60122.patch --- gpsd-3.25/debian/patches/CVE-2026-60122.patch 1970-01-01 00:00:00.000000000 +0000 +++ gpsd-3.25/debian/patches/CVE-2026-60122.patch 2026-07-25 21:40:31.000000000 +0000 @@ -0,0 +1,50 @@ +From: Gary E. Miller +Subject: gpsprof: ensure sats.used is boolean + +gpsd through release-3.27.5 contains a code injection vulnerability in the +gpsprof utility that allows an attacker who controls GPS input data to +execute arbitrary OS commands by injecting malicious content into the +SKY.satellites[].used field, which is inserted unsanitized into a gnuplot +heredoc data block. An attacker can supply a used value containing the +string EOD to terminate the heredoc early and append gnuplot system() +calls, achieving OS command execution as the user running gpsprof when the +generated plot script is processed by gnuplot in polar mode. + +Force sat.used to a real boolean so nothing attacker controlled can reach +the generated gnuplot program. + +Backported to 3.25: the polarplot hunk needed rebasing, as 3.25 spells the +guard as a single line, "if (('polarused' == self.name) and (sat['used'] is +False)):", where 3.27.5 splits it over two lines. No functional difference. + +Origin: backport, https://gitlab.com/gpsd/gpsd/-/commit/5a9c44a42136b9bb98d460a8a716e9fd344a8d93 +Applied-Upstream: 5a9c44a42136b9bb98d460a8a716e9fd344a8d93 +Bug: https://gitlab.com/gpsd/gpsd/-/work_items/406 +Last-Update: 2026-07-25 + +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -367,8 +367,11 @@ class spaceplot(plotter): + # get sat used count + sats_used = 0 + for sat in self.session.satellites: +- if sat.used: ++ if sat.used is True: + sats_used += 1 ++ else: ++ # ensure it is boolean. ++ sat.used = False + + if 'altHAE' not in self.session.data: + self.session.data['altHAE'] = gps.NaN +@@ -814,6 +817,10 @@ class polarplot(plotter): + used += 1 + if 'polarunused' == self.name: + continue ++ else: ++ # ensure it is boolean. ++ sat['used'] = False; ++ + if (('polarused' == self.name) and (sat['used'] is False)): + continue + self.fixes.append((sat['PRN'], sat['ss'], sat['az'], diff -Nru gpsd-3.25/debian/patches/series gpsd-3.25/debian/patches/series --- gpsd-3.25/debian/patches/series 2026-01-17 16:51:45.000000000 +0000 +++ gpsd-3.25/debian/patches/series 2026-07-25 21:40:31.000000000 +0000 @@ -7,3 +7,5 @@ build-on-hurd.patch CVE-2025-67268.patch CVE-2025-67269.patch +CVE-2026-58459.patch +CVE-2026-60122.patch