-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 25 Aug 2026 16:56:38 +0800
Source: freecad
Binary: freecad-python3 freecad-python3-dbgsym libfreecad-python3 libfreecad-python3-dbgsym
Architecture: arm64
Version: 1.0.0+dfsg-8+deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: arm64 Build Daemon (arm-ubc-02) <buildd_arm64-arm-ubc-02@buildd.debian.org>
Changed-By: Aron Xu <aron@debian.org>
Description:
 freecad-python3 - Extensible Open Source CAx program - Python 3 binaries
 libfreecad-python3 - Extensible Open Source CAx program - Python 3 library files
Changes:
 freecad (1.0.0+dfsg-8+deb13u3) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * CVE-2026-34398, CVE-2026-34399: arbitrary Python code execution via
     eval() on untrusted input in the BIM workbench
   * CVE-2026-34789: restrict imports to modules located under FreeCAD's
     own Mod and macro directories.
   * CVE-2026-73233: the escaping helper in the FEM displacement
     constraint task dialog neutralised quotation marks but not
     backslashes, allowing Python code injection through a crafted
     displacement formula.
   * CVE-2026-73235: the Xerces SAX2 reader for FCStd Document.xml
     resolved external entities and loaded external DTDs, allowing local
     file disclosure via file: URIs and SSRF via http: URIs.
   * CVE-2026-73234: PropertyFileIncluded::Restore() concatenated an
     attacker-controlled file attribute from Document.xml with the
     document transient path without rejecting directory components,
     absolute paths or parent references, so a crafted FCStd archive
     could write anywhere the user can write.
Checksums-Sha1:
 6c0ac7746a72e2b8b4bdc97264ea0b894bd81b28 995780 freecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_arm64.deb
 3c7fc2255f7d2ba01e788892e73d843cbb5c7621 86700 freecad-python3_1.0.0+dfsg-8+deb13u3_arm64.deb
 3b59cac24bafdd2cf50180af993f8553ca5f1ec3 36536 freecad_1.0.0+dfsg-8+deb13u3_arm64-buildd.buildinfo
 e9a84e7cda46d17c3b59551a5ca27d78ccc23885 532081924 libfreecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_arm64.deb
 2c2696afc94f0a9e081b1360af95d37a13a66aa6 56687904 libfreecad-python3_1.0.0+dfsg-8+deb13u3_arm64.deb
Checksums-Sha256:
 72846d2c68370cb349396785e4b0f9d7b4c0f58ce2cd2e24635b906213e26d0a 995780 freecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_arm64.deb
 bc0a973ae8b768502325041f1b9f23cf9edec6ee38e13d6566570e9cc23010cb 86700 freecad-python3_1.0.0+dfsg-8+deb13u3_arm64.deb
 93bbb0b895cd48e1fa4b7399a8c1ab4eefebfac82338f18bcbe1e3d65db5b810 36536 freecad_1.0.0+dfsg-8+deb13u3_arm64-buildd.buildinfo
 e03c63c881a483d9e77f177cef8f306ecf259b62c302af6144017ca4d3bebacb 532081924 libfreecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_arm64.deb
 7ca9694d21a32ceeeae4fcbcd5b84cbb8a15939be6abcb9d62a6db2eb7600182 56687904 libfreecad-python3_1.0.0+dfsg-8+deb13u3_arm64.deb
Files:
 482397eadad132d74e89de167a68bc32 995780 debug optional freecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_arm64.deb
 bfe816d65afe334bd4aa7c3c9542283d 86700 science optional freecad-python3_1.0.0+dfsg-8+deb13u3_arm64.deb
 75f6559383680183416be385e5efd332 36536 science optional freecad_1.0.0+dfsg-8+deb13u3_arm64-buildd.buildinfo
 cbe01c1c76c3170cb8ba7bd658e15abf 532081924 debug optional libfreecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_arm64.deb
 4816cca163aad3719ca63f66fa99a004 56687904 libs optional libfreecad-python3_1.0.0+dfsg-8+deb13u3_arm64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEJkN0BnKzGWWW6tS+G5VHrWJmwgcFAmqNiuoACgkQG5VHrWJm
wgf56w//Zl3R7kLOEzfw5Iz9WPNA2PRulYVnbRCqnCL3iTfrj9CnaX8+8QdxzTQL
zQEtXg6V4C/xoCS1F/QJrq6kbBTRLq5ieTTSk2b4WF9XzvVHoICLH8xnFSLWaCOM
XxY12oaq7bnmTm69KsZQCWar6UR/zZ2ngaJKm1YA384w0qbybZay346cWi9VCFZf
oZFyxIj01OmBAjg4Tx0PksdNHjd4+Zw5JOtk/7Qf5rIPJTWyoNKQjQLrSWW6gtSZ
wnaetkephxGIzuXrppej28B8qmmXP9okd1qN+0685GOQ6sw9Gs0xFyVr4a3qynj/
a1IHLyEE28myaqueIXduj/P+m10j5wOcbMjjkYr6uNk17TKPp5rcLPXHOlQbQ/X1
e/tHP/s4NlPpEvjNq5Q4XdjzR8+RYz5zGcrmLbXKlkQRvUk5+DjEDuh/1rz9x9wc
yx6l1fe0+uWfcjoCWmJosB9e9GQyLA2lb5+S6RccKqJb6d+G7suSj3YS49b52mdi
XFX+NWJ4LVH11GlGH2DBxUAU5VMcLZkL14/h/BW+VETv+eJpytw1tunLMnqefzVH
4GhDix97DVfr00TXyG+98xwO2ERgknNNLABjIvbRTsVzfc/igMW5gSAO9qVNTiPJ
BK9/4dkKJQSBdjoKz6ZY4E5I+BSOniMG1jZl++NtfsrSob4FXVw=
=1l/D
-----END PGP SIGNATURE-----