-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 25 Aug 2026 16:56:38 +0800 Source: freecad Architecture: source Version: 1.0.0+dfsg-8+deb13u3 Distribution: trixie-security Urgency: high Maintainer: Debian Science Maintainers <debian-science-maintainers@lists.alioth.debian.org> Changed-By: Aron Xu <aron@debian.org> Changes: freecad (1.0.0+dfsg-8+deb13u3) trixie-security; urgency=high . * Non-maintainer upload by the Security Team. * CVE-2026-34398, CVE-2026-34399: arbitrary Python code execution via eval() on untrusted input in the BIM workbench * CVE-2026-34789: restrict imports to modules located under FreeCAD's own Mod and macro directories. * CVE-2026-73233: the escaping helper in the FEM displacement constraint task dialog neutralised quotation marks but not backslashes, allowing Python code injection through a crafted displacement formula. * CVE-2026-73235: the Xerces SAX2 reader for FCStd Document.xml resolved external entities and loaded external DTDs, allowing local file disclosure via file: URIs and SSRF via http: URIs. * CVE-2026-73234: PropertyFileIncluded::Restore() concatenated an attacker-controlled file attribute from Document.xml with the document transient path without rejecting directory components, absolute paths or parent references, so a crafted FCStd archive could write anywhere the user can write. Checksums-Sha1: 25f430da2002e5f7fb922879677c818cf86b47f6 3303 freecad_1.0.0+dfsg-8+deb13u3.dsc 6d6b770f66dc9a9ab8e8f78979750ec5cfa92f0f 53702404 freecad_1.0.0+dfsg.orig.tar.xz 221711d7a5d6cd60e377575ee82fadd15c91acd4 80668 freecad_1.0.0+dfsg-8+deb13u3.debian.tar.xz 2eec47e74ee4f4753f6e4a3365fc77b7ca96e66b 13598 freecad_1.0.0+dfsg-8+deb13u3_source.buildinfo Checksums-Sha256: fad40fc41579014e7de919d7ee2cf9aee544e6ca251bd28f3aefc9bee3e2ddf8 3303 freecad_1.0.0+dfsg-8+deb13u3.dsc 2c4830acf61808886a26182b8212c1dbb3e642af1974f14e164a4765097d82c0 53702404 freecad_1.0.0+dfsg.orig.tar.xz 0c4f9d02e668c6b4d5afb0a794bce8318cd54d7efb939048672b6fe2e01f6e29 80668 freecad_1.0.0+dfsg-8+deb13u3.debian.tar.xz 6188ae0feb5aa2c08facd20a0336a3d4a387941c21528103b99365c999342a2c 13598 freecad_1.0.0+dfsg-8+deb13u3_source.buildinfo Files: d20751be5d97458631e711bc50c2b352 3303 science optional freecad_1.0.0+dfsg-8+deb13u3.dsc 9f3ce55543ca48d5a801ad950f79b85c 53702404 science optional freecad_1.0.0+dfsg.orig.tar.xz ae2f509a5c17b308eec443d9d6956c5a 80668 science optional freecad_1.0.0+dfsg-8+deb13u3.debian.tar.xz 1b30c31b29bc853fc440abc2587386f8 13598 science optional freecad_1.0.0+dfsg-8+deb13u3_source.buildinfo -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmqNezoACgkQ+GQ1dHE8 m67hpQgA5Bp5O+CxfFPPJNY34zVzexmHolJIn0TfUn653BJG9ZCp+K+xOVH64dRT 5Up6BgtZ4uDF52HvhW6drMgOnOH2aQtZ3yFp25G38Sn45mM11Eye9Ghs4pP4kHdr CtSgEPpXqZCqXjdICREsW+nOlRrIUC7bfnunDdpvf9WQX1dLg8iAl+pknpfgAUCM wiY53XWsVF3bTrjDzZioP2b2eGaH4dhsiEqEpH8eXDAqO5ICLAKTbXerTBvho5mI RNK6RKjZC/yJQmZOxCsTYvMTZCxWQ+M8saPnWk9iJm1Bbvk1VmdrZl8PpBZCm9nT QgL6GvP30XfcoBRhp2KHTzBt4unUFQ== =gUf9 -----END PGP SIGNATURE-----
