-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 25 Aug 2026 16:56:38 +0800
Source: freecad
Binary: freecad-python3 freecad-python3-dbgsym libfreecad-python3 libfreecad-python3-dbgsym
Architecture: riscv64
Version: 1.0.0+dfsg-8+deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: riscv64 Build Daemon (rv-osuosl-03) <buildd_riscv64-rv-osuosl-03@buildd.debian.org>
Changed-By: Aron Xu <aron@debian.org>
Description:
 freecad-python3 - Extensible Open Source CAx program - Python 3 binaries
 libfreecad-python3 - Extensible Open Source CAx program - Python 3 library files
Changes:
 freecad (1.0.0+dfsg-8+deb13u3) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * CVE-2026-34398, CVE-2026-34399: arbitrary Python code execution via
     eval() on untrusted input in the BIM workbench
   * CVE-2026-34789: restrict imports to modules located under FreeCAD's
     own Mod and macro directories.
   * CVE-2026-73233: the escaping helper in the FEM displacement
     constraint task dialog neutralised quotation marks but not
     backslashes, allowing Python code injection through a crafted
     displacement formula.
   * CVE-2026-73235: the Xerces SAX2 reader for FCStd Document.xml
     resolved external entities and loaded external DTDs, allowing local
     file disclosure via file: URIs and SSRF via http: URIs.
   * CVE-2026-73234: PropertyFileIncluded::Restore() concatenated an
     attacker-controlled file attribute from Document.xml with the
     document transient path without rejecting directory components,
     absolute paths or parent references, so a crafted FCStd archive
     could write anywhere the user can write.
Checksums-Sha1:
 4a5950e16d55cca8580235bb1a37d96f5bd38361 863572 freecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_riscv64.deb
 c39b258f140a7a57cc3b736d2b3a60a2d25dea7b 91092 freecad-python3_1.0.0+dfsg-8+deb13u3_riscv64.deb
 2b810b101786714103ded7c9d2a97dc46c5b82e1 35445 freecad_1.0.0+dfsg-8+deb13u3_riscv64-buildd.buildinfo
 0de3a3790773d11ad7acd932918c015994fd0d07 435831480 libfreecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_riscv64.deb
 734f9e7bf91f260573e7f6a7be904ce2b91315bc 58517484 libfreecad-python3_1.0.0+dfsg-8+deb13u3_riscv64.deb
Checksums-Sha256:
 df3da5c40b31014aacd17b071f13fdc6826d9c32954020de40139cd04884c32e 863572 freecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_riscv64.deb
 120ab3316cf7b95f1a20addc714e08c649dc35e31135aa1a0272c8f75c0af60d 91092 freecad-python3_1.0.0+dfsg-8+deb13u3_riscv64.deb
 0b52d42c3052210e03ac2509035c15646d6f0542a2c64671272b5b9a218a5b2d 35445 freecad_1.0.0+dfsg-8+deb13u3_riscv64-buildd.buildinfo
 51fae3013b0640f496fb81d66bf93f9ca530f207e3376f6d98acc2acf0e95118 435831480 libfreecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_riscv64.deb
 abb72f117d097e568aed929990118a45bef25d902e28ffed6a74de8827233de6 58517484 libfreecad-python3_1.0.0+dfsg-8+deb13u3_riscv64.deb
Files:
 6a84982cc9808b64c4c98146c07ae547 863572 debug optional freecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_riscv64.deb
 5990ac7ed57ac75ae1f8bcc04b42d1c1 91092 science optional freecad-python3_1.0.0+dfsg-8+deb13u3_riscv64.deb
 0e393b9725e2b798f66e51b1e153f341 35445 science optional freecad_1.0.0+dfsg-8+deb13u3_riscv64-buildd.buildinfo
 170f2e1fbcdc08fe00d442e9b053b0c8 435831480 debug optional libfreecad-python3-dbgsym_1.0.0+dfsg-8+deb13u3_riscv64.deb
 1d0ff462781a5a36182b784b330470fb 58517484 libs optional libfreecad-python3_1.0.0+dfsg-8+deb13u3_riscv64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEExv8RwtKAmv8J56r/6ETk30hvxtkFAmqOr8oACgkQ6ETk30hv
xtlC4RAAy8dd7u+aQjcc2Q6ERjjP635GBI3YDSAD+JfDwZndscLxntxn15R/veCL
uNZ6OExOAxb6C8p4/iUHB0mUAW3+q8c8chkAkhouDewVZQbvQKXfRXSr5HI/uBwM
KDl6Q2nn8JwSA0PO5WZcJOvZhB/RHgVAebgtX4zaYpM2ZKslDv0dcxoh4aVFi1Tf
jVUzvtidCrt4KOJOElOEJRE08ydITXGxraFr+D8PG3TsBu0iA8p0kBIWPKTiVgbe
CzH3KyopE2bieoT+i+GPThYe6UW1TetM5XN7Hmm74ORzNnJSGQR3JRVVGDqRmsP3
1ONwByZ/o1wG11p4gn/gOXWWTU55pgBGG1N/EYTMtEZtJIvft1XEE7sGobOs3Zqa
9Fal8KcGmxOLvofIaC7hBS2om8GkbuNSI1oDdmFSlHncOc2swTGyfDq8PUfZnLY6
SzTeqYHmCYEHbugkNR7Jcz7VRLOevnFEXdDmPQPuOPLKkEQeE0snBiBA8fWaEH45
jyYlfmNd/dG7jU2JvRXoFIaeK2vAjuJotgXgo7GHadkDQrm24Y5YUc+BRRMi7QZf
Ua3K8Sw7xD8CBFB54nLrj1VU1br89Sc7PECfa0nmxxrFleHhAzy6dX8uBo0VUlq2
yHAsZh+Su4YcD3U+08Lw/hGR1QCTqI/l8vN4FnLdwwVd8lXs2kE=
=sOCW
-----END PGP SIGNATURE-----