Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.changes > #14299

Accepted freecad 1.0.0+dfsg-8+deb13u3 (source) into proposed-updates

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 25 Aug 2026 16:56:38 +0800
Source: freecad
Architecture: source
Version: 1.0.0+dfsg-8+deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: Debian Science Maintainers <debian-science-maintainers@lists.alioth.debian.org>
Changed-By: Aron Xu <aron@debian.org>
Changes:
 freecad (1.0.0+dfsg-8+deb13u3) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * CVE-2026-34398, CVE-2026-34399: arbitrary Python code execution via
     eval() on untrusted input in the BIM workbench
   * CVE-2026-34789: restrict imports to modules located under FreeCAD's
     own Mod and macro directories.
   * CVE-2026-73233: the escaping helper in the FEM displacement
     constraint task dialog neutralised quotation marks but not
     backslashes, allowing Python code injection through a crafted
     displacement formula.
   * CVE-2026-73235: the Xerces SAX2 reader for FCStd Document.xml
     resolved external entities and loaded external DTDs, allowing local
     file disclosure via file: URIs and SSRF via http: URIs.
   * CVE-2026-73234: PropertyFileIncluded::Restore() concatenated an
     attacker-controlled file attribute from Document.xml with the
     document transient path without rejecting directory components,
     absolute paths or parent references, so a crafted FCStd archive
     could write anywhere the user can write.
Checksums-Sha1:
 25f430da2002e5f7fb922879677c818cf86b47f6 3303 freecad_1.0.0+dfsg-8+deb13u3.dsc
 6d6b770f66dc9a9ab8e8f78979750ec5cfa92f0f 53702404 freecad_1.0.0+dfsg.orig.tar.xz
 221711d7a5d6cd60e377575ee82fadd15c91acd4 80668 freecad_1.0.0+dfsg-8+deb13u3.debian.tar.xz
 2eec47e74ee4f4753f6e4a3365fc77b7ca96e66b 13598 freecad_1.0.0+dfsg-8+deb13u3_source.buildinfo
Checksums-Sha256:
 fad40fc41579014e7de919d7ee2cf9aee544e6ca251bd28f3aefc9bee3e2ddf8 3303 freecad_1.0.0+dfsg-8+deb13u3.dsc
 2c4830acf61808886a26182b8212c1dbb3e642af1974f14e164a4765097d82c0 53702404 freecad_1.0.0+dfsg.orig.tar.xz
 0c4f9d02e668c6b4d5afb0a794bce8318cd54d7efb939048672b6fe2e01f6e29 80668 freecad_1.0.0+dfsg-8+deb13u3.debian.tar.xz
 6188ae0feb5aa2c08facd20a0336a3d4a387941c21528103b99365c999342a2c 13598 freecad_1.0.0+dfsg-8+deb13u3_source.buildinfo
Files:
 d20751be5d97458631e711bc50c2b352 3303 science optional freecad_1.0.0+dfsg-8+deb13u3.dsc
 9f3ce55543ca48d5a801ad950f79b85c 53702404 science optional freecad_1.0.0+dfsg.orig.tar.xz
 ae2f509a5c17b308eec443d9d6956c5a 80668 science optional freecad_1.0.0+dfsg-8+deb13u3.debian.tar.xz
 1b30c31b29bc853fc440abc2587386f8 13598 science optional freecad_1.0.0+dfsg-8+deb13u3_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmqNezoACgkQ+GQ1dHE8
m67hpQgA5Bp5O+CxfFPPJNY34zVzexmHolJIn0TfUn653BJG9ZCp+K+xOVH64dRT
5Up6BgtZ4uDF52HvhW6drMgOnOH2aQtZ3yFp25G38Sn45mM11Eye9Ghs4pP4kHdr
CtSgEPpXqZCqXjdICREsW+nOlRrIUC7bfnunDdpvf9WQX1dLg8iAl+pknpfgAUCM
wiY53XWsVF3bTrjDzZioP2b2eGaH4dhsiEqEpH8eXDAqO5ICLAKTbXerTBvho5mI
RNK6RKjZC/yJQmZOxCsTYvMTZCxWQ+M8saPnWk9iJm1Bbvk1VmdrZl8PpBZCm9nT
QgL6GvP30XfcoBRhp2KHTzBt4unUFQ==
=gUf9
-----END PGP SIGNATURE-----

Back to linux.debian.changes | Previous | Next | Find similar | Unroll thread

Thread

Accepted freecad 1.0.0+dfsg-8+deb13u3 (source) into proposed-updates Debian FTP Masters <ftpmaster@ftp-master.debian.org> - 2026-08-31 15:50 +0200

csiph-web