-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 25 Aug 2026 16:56:38 +0800
Source: freecad
Binary: freecad freecad-common
Architecture: all
Version: 1.0.0+dfsg-8+deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: all Build Daemon (x86-csail-02) <buildd_all-x86-csail-02@buildd.debian.org>
Changed-By: Aron Xu <aron@debian.org>
Description:
 freecad    - Extensible Open Source CAx program
 freecad-common - Extensible Open Source CAx program - common files
Changes:
 freecad (1.0.0+dfsg-8+deb13u3) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * CVE-2026-34398, CVE-2026-34399: arbitrary Python code execution via
     eval() on untrusted input in the BIM workbench
   * CVE-2026-34789: restrict imports to modules located under FreeCAD's
     own Mod and macro directories.
   * CVE-2026-73233: the escaping helper in the FEM displacement
     constraint task dialog neutralised quotation marks but not
     backslashes, allowing Python code injection through a crafted
     displacement formula.
   * CVE-2026-73235: the Xerces SAX2 reader for FCStd Document.xml
     resolved external entities and loaded external DTDs, allowing local
     file disclosure via file: URIs and SSRF via http: URIs.
   * CVE-2026-73234: PropertyFileIncluded::Restore() concatenated an
     attacker-controlled file attribute from Document.xml with the
     document transient path without rejecting directory components,
     absolute paths or parent references, so a crafted FCStd archive
     could write anywhere the user can write.
Checksums-Sha1:
 290c75f95098a61e8e7e6080bcfbb68f14b20921 22798976 freecad-common_1.0.0+dfsg-8+deb13u3_all.deb
 7cc1bc9c8846d9a6661e147280fa1b219a5311e0 35967 freecad_1.0.0+dfsg-8+deb13u3_all-buildd.buildinfo
 42745d60d3b3221d4d879f196dd1b93834bcc4ff 28692 freecad_1.0.0+dfsg-8+deb13u3_all.deb
Checksums-Sha256:
 b6cb7be9f96f250ad103ad1714474e13b7adf5245e83d3bd0b55f5982c6a050e 22798976 freecad-common_1.0.0+dfsg-8+deb13u3_all.deb
 24c3991d13fdac205d597e6424d85c1becc12ad0f1fba868e69422eaf4afa9c8 35967 freecad_1.0.0+dfsg-8+deb13u3_all-buildd.buildinfo
 b3e025aff151944437968655b0170c853a1d2b776851ad64c9c85b75b3b2c115 28692 freecad_1.0.0+dfsg-8+deb13u3_all.deb
Files:
 5196aaf6bbb7ee40b152e73d98675821 22798976 science optional freecad-common_1.0.0+dfsg-8+deb13u3_all.deb
 d7c18b692ffe2b7367277a488906c9c5 35967 science optional freecad_1.0.0+dfsg-8+deb13u3_all-buildd.buildinfo
 dc059969aae1102863d97cc71c4e7bbc 28692 science optional freecad_1.0.0+dfsg-8+deb13u3_all.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXLxUpUHQBQBTDtd4aBVi67oXtfkFAmqNjCMACgkQaBVi67oX
tflfGg//beNGpIBcfAMWrjbWzVnSFNNP7MR7+6yfsa5I3RxutqmHnxidzKHPY90l
nbBVCvgJE19u+PXxV1SlZj5lofK05A6IFcy4eplbSV1tniL3ICRExjLm6vkBOjN6
8xElaqzchdKW0MoiDjZNLJfMng5WXnAMz8gssTFYekNcQ7Qvjfu1Zf1Oc0t9bjGY
2E2ePWD/UAuNREz1sECDNwdXiB9nbiby1a5zqQMlcNK5UvolLX4kxJegYsbT4Zzv
zUA8k73K/Zh+hzx0gvQgxJ3HakUYiXnpXlX/t5RZoIjT6NE6Rbj4lsjPqXyVjwLK
OTN0T+YJzK7rFcnYQUhP+JBJk8onNURyb/Zi6ANyM3wqv1jtbC3nc+dfvNitvLu/
gAwaGtII5uW6i500VUtFP9tR+nfIld8GRw8JqGN74Yb+mZFvaBzMNlszKkST9AeJ
+U1PYFpVbMLKjAq4+r3UusVM/hkq83B09ArAGtIgOmbJwUZeI0lPRVlbxndMGyYG
b2Ehw8ulOSAkEozW1B4+buZrAAcID9YeVhrmfsKIBBzPOBRw5/Q9jbClLhvLP8oW
76p6uyBrqvntZ8LlSX6hpc4FNAc0uZdsUXvoeIlKdvHdZLid4FltMrL7KdbJLvEs
FxL/ICR3iZXtnA/g5CxP2x7oqJExIjQ5R2XJYw8ErLNKMAPziZU=
=pwsH
-----END PGP SIGNATURE-----