-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 25 Aug 2026 16:56:38 +0800 Source: freecad Binary: freecad-python3 freecad-python3-dbgsym libfreecad-python3 libfreecad-python3-dbgsym Architecture: armhf Version: 1.0.0+dfsg-8+deb13u3 Distribution: trixie-security Urgency: high Maintainer: armhf Build Daemon (arm-conova-01) Changed-By: Aron Xu Description: freecad-python3 - Extensible Open Source CAx program - Python 3 binaries libfreecad-python3 - Extensible Open Source CAx program - Python 3 library files Changes: freecad (1.0.0+dfsg-8+deb13u3) trixie-security; urgency=high . * Non-maintainer upload by the Security Team. * CVE-2026-34398, CVE-2026-34399: arbitrary Python code execution via eval() on untrusted input in the BIM workbench * CVE-2026-34789: restrict imports to modules located under FreeCAD's own Mod and macro directories. * CVE-2026-73233: the escaping helper in the FEM displacement constraint task dialog neutralised quotation marks but not backslashes, allowing Python code injection through a crafted displacement formula. * CVE-2026-73235: the Xerces SAX2 reader for FCStd Document.xml resolved external entities and loaded external DTDs, allowing local file disclosure via file: URIs and SSRF via http: URIs. * CVE-2026-73234: PropertyFileIncluded::Restore() concatenated an attacker-controlled file attribute from Document.xml with the document transient path without rejecting directory components, absolute paths or parent references, so a crafted FCStd archive could write anywhere the user can write. Checksums-Sha1: 0c2a65cb8a9c6d19ac11ce2de1e54a6de8246e35 962472 freecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_armhf.deb 8be5ab932d7f679ccd7a21ca5f287839cc9e4a9f 77768 freecad-python3_1.0.0+dfsg-8+deb13u3_armhf.deb 88dacea8a23af55c002802af3a1b74440ba69f58 35409 freecad_1.0.0+dfsg-8+deb13u3_armhf-buildd.buildinfo c8d9cc6e4ac0cb0d10750913dafe315f463ba991 512972424 libfreecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_armhf.deb 7250f6182b66464a8c7cd1e4fe2f3b9b5a6fe1a4 55265692 libfreecad-python3_1.0.0+dfsg-8+deb13u3_armhf.deb Checksums-Sha256: 37f6bc58af7aeee61adc187f1e78eda7a46b6db41356035b58937bb5c0105ca7 962472 freecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_armhf.deb a1a102f28e702cd23d7a254a5a916127f6ded7b1e0db84732562063660a471bc 77768 freecad-python3_1.0.0+dfsg-8+deb13u3_armhf.deb ef7e316177b26750b1827bb27976345cca93ad8f1383bd1c6bcf8e71caa2738c 35409 freecad_1.0.0+dfsg-8+deb13u3_armhf-buildd.buildinfo 723f4adfec713d1256b1c0c3adf922414979948bedacc5f194a7bb064ae5071b 512972424 libfreecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_armhf.deb 44b04fd4ce78a4e524e37a7ada76313231f35b45e6add65b6b1c94d5ea0cea47 55265692 libfreecad-python3_1.0.0+dfsg-8+deb13u3_armhf.deb Files: 28e10781ab5263a21a31948fc294aff6 962472 debug optional freecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_armhf.deb db2a569e3891c7b05f6c90d2bf34829e 77768 science optional freecad-python3_1.0.0+dfsg-8+deb13u3_armhf.deb cf2ac437e4af39e9db4187c5ce8bf193 35409 science optional freecad_1.0.0+dfsg-8+deb13u3_armhf-buildd.buildinfo 8aec6aff0c7fc82c35f3a004f13e749a 512972424 debug optional libfreecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_armhf.deb 1be44049857df092d0ded542f8fd6e9a 55265692 libs optional libfreecad-python3_1.0.0+dfsg-8+deb13u3_armhf.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO4qAQUSIo2p/kVRf8U6eOZMpj68FAmqNivIACgkQ8U6eOZMp j6+r6g/+JfEKMm8NYWvrCP9qD8wTxKGm502Jye/dm0b3OBE3NixzSUQaLWVv2YPK Kt+hi7d+89bQxQT9VfU7SAYXNaKtv3z73tWEMZwPpTNgqXuWfMJI/SMMsQREXW/r 1ns1AjhfvOHUht3iAYRREtAE1DHUbgBAD+UIyPYVv5XRqdGluf7POERDL+ZEnsOz 6JW077ORPfAOB94kCpeIw8L0IAGpGR0jbOnm896N32X2r7jLrk6OWCGud7w8nJen 6WdG/yYAHvPoGOKetz7UPVJp6xqFd3Beut37AXAvtd0qJQfHUSJ34OaU408BVBLo mAS2pKwk1R0aLoEb1WZ+M3+WthL3PUkkScixXTkIomreLV3U32IKVw31oX48hBoK kMrJg/+BeHXOsa3bbhJARuOt8UhzvdYKLnkRzss3KyqOehDKQl5msz/98nGXVAhn 1wuN12sGmbuWzu10bf99MgRIWEaZAMC1K37Q/lZ24XBCuVAh08hfdohLZvnle7MT CtxTJ+U4vXNgZp/cOh/xpTNZif4ZE9d61E00RHt473/IbR1bX++xh+UWT9z4Rfe+ RYiCyrAaT9w/T8alUKCUg4yf/OUSRSD4ctDQYN7Atr2wPA0u/kgn+cTQSDjr/shW 1/zR0+Hp24ddVFPPWDozBayicyF92UpLBk7FlniS0ttytVT/y+s= =UGhF -----END PGP SIGNATURE-----