-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 25 Aug 2026 16:56:38 +0800
Source: freecad
Binary: freecad-python3 freecad-python3-dbgsym libfreecad-python3 libfreecad-python3-dbgsym
Architecture: ppc64el
Version: 1.0.0+dfsg-8+deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: ppc64el Build Daemon (ppc64el-conova-02) <buildd_ppc64el-ppc64el-conova-02@buildd.debian.org>
Changed-By: Aron Xu <aron@debian.org>
Description:
 freecad-python3 - Extensible Open Source CAx program - Python 3 binaries
 libfreecad-python3 - Extensible Open Source CAx program - Python 3 library files
Changes:
 freecad (1.0.0+dfsg-8+deb13u3) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * CVE-2026-34398, CVE-2026-34399: arbitrary Python code execution via
     eval() on untrusted input in the BIM workbench
   * CVE-2026-34789: restrict imports to modules located under FreeCAD's
     own Mod and macro directories.
   * CVE-2026-73233: the escaping helper in the FEM displacement
     constraint task dialog neutralised quotation marks but not
     backslashes, allowing Python code injection through a crafted
     displacement formula.
   * CVE-2026-73235: the Xerces SAX2 reader for FCStd Document.xml
     resolved external entities and loaded external DTDs, allowing local
     file disclosure via file: URIs and SSRF via http: URIs.
   * CVE-2026-73234: PropertyFileIncluded::Restore() concatenated an
     attacker-controlled file attribute from Document.xml with the
     document transient path without rejecting directory components,
     absolute paths or parent references, so a crafted FCStd archive
     could write anywhere the user can write.
Checksums-Sha1:
 542c679ff1cb8e029e5f94a12800ee04d700da62 1015404 freecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_ppc64el.deb
 9a0da953f89198682bb482a91ea98b0544db627c 93328 freecad-python3_1.0.0+dfsg-8+deb13u3_ppc64el.deb
 1b5fb4943441737f601004a133a6591ef126d02a 35712 freecad_1.0.0+dfsg-8+deb13u3_ppc64el-buildd.buildinfo
 8379c05cc92d0fb41a7488eaf44b58f256947469 538008072 libfreecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_ppc64el.deb
 bc768be4c3c35276d9363576debdc52a2a65ee2f 58769136 libfreecad-python3_1.0.0+dfsg-8+deb13u3_ppc64el.deb
Checksums-Sha256:
 71417c3870d60a0819c84132faf77af5d13df81951e6cb1e4496d86bb6c4e090 1015404 freecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_ppc64el.deb
 2f21d4a61b70f59b8e69837153ca0c0cd42d822c5fc3f04952f61de023ca9a82 93328 freecad-python3_1.0.0+dfsg-8+deb13u3_ppc64el.deb
 2771d574092d7feb724558c4d5614ca95862ade6fcbbefcf150b08e0394da3e5 35712 freecad_1.0.0+dfsg-8+deb13u3_ppc64el-buildd.buildinfo
 91d603dc834d012ad32d96a444c4c34f81f902f750421ee0fd1d24eb2f316a36 538008072 libfreecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_ppc64el.deb
 e325ce461efb7b08b1607fb4521006751323084f513c31798692987b596d2953 58769136 libfreecad-python3_1.0.0+dfsg-8+deb13u3_ppc64el.deb
Files:
 36e347411d63c3b5d5d2a867ef101e9c 1015404 debug optional freecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_ppc64el.deb
 8c608ceff1546e222eeb831d91019dac 93328 science optional freecad-python3_1.0.0+dfsg-8+deb13u3_ppc64el.deb
 0a85f738ce4024dcf6b34846d307a76e 35712 science optional freecad_1.0.0+dfsg-8+deb13u3_ppc64el-buildd.buildinfo
 537fb7873c0c39b7ba0f19ed5d88863a 538008072 debug optional libfreecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_ppc64el.deb
 7da7fe5080115e674fc2634003d08b6d 58769136 libs optional libfreecad-python3_1.0.0+dfsg-8+deb13u3_ppc64el.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEySUEQfg5pZeb/U372FRWNm40e2YFAmqNjQAACgkQ2FRWNm40
e2YYjA/+MuSe83m1ywSMcLp/wOip3L6PpzzZVNt/jHk0tb1wNHLfp0yNV0GAG947
qolYX2zZeMh8vzW/QKUN2lO/MRgbcoa6YeUFTaHjpsciwPfqk94ZgHaejaryZ4gt
O1H131H9b3rO/m+659KTHfBOKyq9pu5Wfb3j6N0FsWgeQUv4OJxaebgq9FbHL2+6
D3Ky4A44AWOPANFEmSQ4AtvbxjIxau1Mi3F77+NKznFgnhY8k2P7oLiqbdZ5rZN2
BNDzPkle0qIx9R/eiA1Gaz2cNEn1dEXlByHlp3Br615GVjF+HKuJkrfRI8PG2IO+
osMLni4IZvlfKnb7IUM4amiHEBVg192mjazNpMhbx4Fe2+oCV+b+a7QfRslW09xz
G/Pa7Ii0Hr4FMluzlT12CoB14X0Z+9BRexsZapvuMdB/cF6Qt0Z1otEuDGej/ZS8
jKrgi589cOwseL+lDtWFOFnto+PgxVbiogpYGmVWsb7b04SZLr6TW486ayf7ApXx
hfj1QYCecQ/g9AzxOy4Zk5zbBSY9qHMJhuztlCKlxqG7iddW6EqSXAhEvNJVw2h4
hhkZ/T4R9aOUTPPpIHc4J7iUt/7j3hKozHsvaet92c2lmeaPK3WHYO6v8eeW+U9o
rBXe7L/Jy8QWvQ1fsxMtNX/7OSE73VbCmjUfVU+rcnPH1b1VmXg=
=piJh
-----END PGP SIGNATURE-----