-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 25 Aug 2026 16:56:38 +0800
Source: freecad
Binary: freecad-python3 freecad-python3-dbgsym libfreecad-python3 libfreecad-python3-dbgsym
Architecture: amd64
Version: 1.0.0+dfsg-8+deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: all / amd64 / i386 Build Daemon (x86-conova-01) <buildd_amd64-x86-conova-01@buildd.debian.org>
Changed-By: Aron Xu <aron@debian.org>
Description:
 freecad-python3 - Extensible Open Source CAx program - Python 3 binaries
 libfreecad-python3 - Extensible Open Source CAx program - Python 3 library files
Changes:
 freecad (1.0.0+dfsg-8+deb13u3) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * CVE-2026-34398, CVE-2026-34399: arbitrary Python code execution via
     eval() on untrusted input in the BIM workbench
   * CVE-2026-34789: restrict imports to modules located under FreeCAD's
     own Mod and macro directories.
   * CVE-2026-73233: the escaping helper in the FEM displacement
     constraint task dialog neutralised quotation marks but not
     backslashes, allowing Python code injection through a crafted
     displacement formula.
   * CVE-2026-73235: the Xerces SAX2 reader for FCStd Document.xml
     resolved external entities and loaded external DTDs, allowing local
     file disclosure via file: URIs and SSRF via http: URIs.
   * CVE-2026-73234: PropertyFileIncluded::Restore() concatenated an
     attacker-controlled file attribute from Document.xml with the
     document transient path without rejecting directory components,
     absolute paths or parent references, so a crafted FCStd archive
     could write anywhere the user can write.
Checksums-Sha1:
 60c3269d8f6c6ddc1d14668f5f3a1c144047e138 1019048 freecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_amd64.deb
 12d5c79d4c73ed5bbb6b3e40a8c545bb2aacd27f 92460 freecad-python3_1.0.0+dfsg-8+deb13u3_amd64.deb
 7d67908c7efe191d48c53e0950b8790f35628496 36660 freecad_1.0.0+dfsg-8+deb13u3_amd64-buildd.buildinfo
 3ab706a82c828c361686d9288545d6e4fccbef82 542574636 libfreecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_amd64.deb
 b8b3493b212337c4fe890c24e9315fa85c3d6eee 59283748 libfreecad-python3_1.0.0+dfsg-8+deb13u3_amd64.deb
Checksums-Sha256:
 312e3b62d2fdcd0c9b5ed7c91d7977878270749dae0c629e367023aff2c53f17 1019048 freecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_amd64.deb
 dd5e697469640d1f3e333c70a5efd3fa5658d31b63b11c369c22a449ebf090ff 92460 freecad-python3_1.0.0+dfsg-8+deb13u3_amd64.deb
 813b2b65a275a793102ed21ff43b6ec5bcd81972892ea1ff2843792e65b8b689 36660 freecad_1.0.0+dfsg-8+deb13u3_amd64-buildd.buildinfo
 27ab7cf26def4210d8eb5419d8f0fe1bb4b7cb80f3501337109c562033369b69 542574636 libfreecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_amd64.deb
 eab4fe4c51c08316268afa8d4d15aa3548c49772248cbce889803d7fbcd2aace 59283748 libfreecad-python3_1.0.0+dfsg-8+deb13u3_amd64.deb
Files:
 8aaf3b84afd007ac6baad1b0ac7fc2d5 1019048 debug optional freecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_amd64.deb
 6cac0242cd9d35fe1f1f58b93330ec5d 92460 science optional freecad-python3_1.0.0+dfsg-8+deb13u3_amd64.deb
 6d3dcaca1d5bd9352602645bb0b46a47 36660 science optional freecad_1.0.0+dfsg-8+deb13u3_amd64-buildd.buildinfo
 21be99ade794a4f13f568b8a7dbff2ae 542574636 debug optional libfreecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_amd64.deb
 2e7518741ae59fa3d412b9ce2fd777c0 59283748 libs optional libfreecad-python3_1.0.0+dfsg-8+deb13u3_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE7cQ9mRD4+dWjjrb6PkCWRKsh20cFAmqNjYcACgkQPkCWRKsh
20cWqRAAoqMJkN8v8wpbWAFZeR+S59o9XOwIG7bhMKV964/ovGAVSHttN5JJ1xul
2V/Z3DFRfTOY0kwwxNXE+LdUdW+7qJPwOfHuiB1zD/K5gWC8tDMYxYO4KXQqrenp
VbLW2w27GefdQT7/Vd/OEiIhJu3ajJICIjwInzB9Z0vYYoobTLdpNlv42mwlCUCt
UsziZnleRMr/qqUNriyFmecp7QMVAVogaaKVaFfVk6gn+ydIXk664/wD7DAItStq
uJlvAA8XllKJn5NokenakUJpoj2ZVlUwo190rmX4DD/s2p4WhIcnKrH6o8aD6PL7
1b9iwipFaPETEPtLqe26404wVBnxFIZ87rwyxOYGR+Id9myuSim05kHS81vbUQeQ
SSjldh62zbLXcFROMQ3SaQx9NIeHIt2L+9jB6my1sssmzPlHM1+raBxxzJu1+X80
L5slO5qFsjOkvjBdh/PHiYPaIYcXmQCgCCa4vy1NHdKC9sY+am8PDHUKKIAnn6j+
PHbMLIYrPnr3fE/0cqClJg4i3NsJbjCW/f52jg1yzT8hMa/eB6LTcB4TYVVeAyJX
9txfdMhVOb5lvIqN8ORJpkfod1VHUR0JGXJlT+qd5A7MVS1tdnsWP+oIGpVUg/G3
DJuu4eHadzRwA0mCzRQG4kbanihmG9EOoJM5xec10mXavpYxOm8=
=jIEO
-----END PGP SIGNATURE-----