From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Miroslav Lichvar To: git-commits@fedoraproject.org Subject: [rpms/gpsd] f44: fix command injection in gpsprof (CVE-2026-58459) Date: Mon, 13 Jul 2026 13:08:59 GMT Message-ID: <178394813963.1.17418055568608670024.rpms-gpsd-fbd0cb963510@fedoraproject.org> List-ID: X-Git-Repo: rpms/gpsd X-Git-Branch: f44 X-Git-Rev: fbd0cb96351032beeb11d02b5482758874bce34a QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvZ3BzZApCcmFuY2gg OiBmNDQKQ29tbWl0IDogZmJkMGNiOTYzNTEwMzJiZWViMTFkMDJiNTQ4Mjc1ODg3NGJjZTM0YQpB dXRob3IgOiBNaXJvc2xhdiBMaWNodmFyIDxtbGljaHZhckByZWRoYXQuY29tPgpEYXRlICAgOiAy MDI2LTA3LTEzVDE0OjUzOjM2KzAyOjAwClN0YXRzICA6ICsxMzIvLTAgaW4gMiBmaWxlKHMpClVS TCAgICA6IGh0dHBzOi8vc3JjLmZlZG9yYXByb2plY3Qub3JnL3JwbXMvZ3BzZC9jL2ZiZDBjYjk2 MzUxMDMyYmVlYjExZDAyYjU0ODI3NTg4NzRiY2UzNGE/YnJhbmNoPWY0NAoKTG9nOgpmaXggY29t bWFuZCBpbmplY3Rpb24gaW4gZ3BzcHJvZiAoQ1ZFLTIwMjYtNTg0NTkpCgotLS0KZGlmZiAtLWdp dCBhL2dwc2QtY3ZlLTIwMjYtNTg0NTkucGF0Y2ggYi9ncHNkLWN2ZS0yMDI2LTU4NDU5LnBhdGNo Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAuLjhlMTA3MTMKLS0tIC9kZXYvbnVs bAorKysgYi9ncHNkLWN2ZS0yMDI2LTU4NDU5LnBhdGNoCkBAIC0wLDAgKzEsMTMwIEBACitjb21t aXQgNTU4MWJhMTk2ZDgyNmE5ODRmYmZhZjc5MmI3ZDU4NTM1Zjk5MTFjZQorQXV0aG9yOiBHYXJ5 IEUuIE1pbGxlciA8Z2VtQHJlbGxpbS5jb20+CitEYXRlOiAgIFdlZCBKdWwgMSAxNzo1NTo1NyAy MDI2IC0wNzAwCisKKyAgICBjbGllbnRzL2dwc3Byb2YucHkuaW46IFF1b3RlIGRvdWJsZSBxdW90 ZXMgaW4gdGl0bGUuCisgICAgCisgICAgU29tZW9uZSBjb3VsZCB1c2UgdGhlIGRvdWJsZSBxdW90 ZSB0byBicmVhayBvdXQgb2YgdGhlCisgICAgc3RyaW5nIGFuZCBhZGQgZ251cGxvdCBjb21tbmRz LgorICAgIAorICAgIEZvciBpc3N1ZSA0MDQuCisgICAgUmVwb3J0ZWQgYnk6IEN1QjN5MG5kLCBh bmQgV2FkZSBTcGFya3MgPHdzcGFya3NAdnVsbmNoZWNrLmNvbT4KKworZGlmZiAtLWdpdCBhL2Ns aWVudHMvZ3BzcHJvZi5weS5pbiBiL2NsaWVudHMvZ3BzcHJvZi5weS5pbgoraW5kZXggNWMxOGY1 MGZmLi4yNjFlNzI2NjUgMTAwNjQ0CistLS0gYS9jbGllbnRzL2dwc3Byb2YucHkuaW4KKysrKyBi L2NsaWVudHMvZ3BzcHJvZi5weS5pbgorQEAgLTE5OCw2ICsxOTgsMTAgQEAgY2xhc3MgcGxvdHRl cihvYmplY3QpOgorICAgICAgICAgaWYgJ3N1YnR5cGUnIGluIHNlbGYuZGV2aWNlOgorICAgICAg ICAgICAgIGRlc2MgKz0gIlxcbiVzIiAlIHNlbGYuZGV2aWNlWydzdWJ0eXBlJ10KKyAKKysgICAg ICAgICMgZXNjYXBlICIsIGFuZCBcbiwgZm9yIGdudXBsb3QsIHRvIG5vdCBicmVhayBzdHJpbmdz CisrICAgICAgICBkZXNjID0gZGVzYy5yZXBsYWNlKCciJywgJ1xcMDQyJykKKysgICAgICAgIGRl c2MgPSBkZXNjLnJlcGxhY2UoJ1xuJywgJycpCisrCisgICAgICAgICByZXR1cm4gZGVzYworIAor ICAgICBkZWYgY29sbGVjdChzZWxmLCB2ZXJiLCBsb2dfZnA9Tm9uZSk6CitAQCAtMTI2MiwxMCAr MTI2NiwxMCBAQCBpZiBfX25hbWVfXyA9PSAnX19tYWluX18nOgorICAgICAgICAgIyBTaGlwIHRo ZSBwbG90IHRvIHN0YW5kYXJkIG91dHB1dAorICAgICAgICAgaWYgbm90IG9wdGlvbnMudGl0bGU6 CisgICAgICAgICAgICAgb3B0aW9ucy50aXRsZSA9IHBsb3Qud2hhdGFtaSgpCistICAgICAgICAg ICAgIyBlc2NhcGUgIiBmb3IgZ251cGxvdAorLSAgICAgICAgICAgIG9wdGlvbnMudGl0bGUgPSBv cHRpb25zLnRpdGxlLnJlcGxhY2UoJyInLCAnXFwiJykKKyAgICAgICAgIGlmIG9wdGlvbnMuc3Vi dGl0bGU6CisgICAgICAgICAgICAgb3B0aW9ucy50aXRsZSArPSAnXFxuJyArIG9wdGlvbnMuc3Vi dGl0bGUKKysgICAgICAgICMgZXNjYXBlICIgZm9yIGdudXBsb3QsIHRvIG5vdCBicmVhayBzdHJp bmdzCisrICAgICAgICBvcHRpb25zLnRpdGxlID0gb3B0aW9ucy50aXRsZS5yZXBsYWNlKCciJywg J1xcMDQyJykKKyAgICAgICAgIHRlcm1fb3B0cyA9ICIiCisgICAgICAgICB0cnVlY29sb3JfdGVy bXMgPSBbJ3BuZycsICdzaXhlbGdkJywgJ3d4dCddCisgICAgICAgICBpZiBvcHRpb25zLnRlcm1p bmFsIGluIHRydWVjb2xvcl90ZXJtczoKKworY29tbWl0IDFhNmJiN2JjYmRmNThhYTk0MDEzMmU2 MzA4NzBhZjA2MWRjODg1MzcKK0F1dGhvcjogR2FyeSBFLiBNaWxsZXIgPGdlbUByZWxsaW0uY29t PgorRGF0ZTogICBUdWUgSnVsIDcgMTM6NDE6NTQgMjAyNiAtMDcwMAorCisgICAgY2xpZW50cy9n cHNwcm9mLnB5LmluOiBRdW90ZSBiYWNrIHRpY2tzIGluIHRpdGxlLgorICAgIAorICAgIFNvbWVv bmUgY291bGQgdXNlIHRoZSBiYWNrIHRpY2sgdG8gYnJlYWsgb3V0IG9mIHRoZSBzdHJpbmcgYW5k IGFkZAorICAgIGdudXBsb3QgY29tbW5kcy4KKyAgICAKKyAgICBGb3IgaXNzdWUgNDA0LgorICAg IFJlcG9ydGVkIGJ5OiBDdUIzeTBuZCwgYW5kIFdhZGUgU3BhcmtzIDx3c3BhcmtzQHZ1bG5jaGVj ay5jb20+CisKK2RpZmYgLS1naXQgYS9jbGllbnRzL2dwc3Byb2YucHkuaW4gYi9jbGllbnRzL2dw c3Byb2YucHkuaW4KK2luZGV4IDI2MWU3MjY2NS4uMjAyMjE0NzY5IDEwMDY0NAorLS0tIGEvY2xp ZW50cy9ncHNwcm9mLnB5LmluCisrKysgYi9jbGllbnRzL2dwc3Byb2YucHkuaW4KK0BAIC0xOTgs OCArMTk4LDkgQEAgY2xhc3MgcGxvdHRlcihvYmplY3QpOgorICAgICAgICAgaWYgJ3N1YnR5cGUn IGluIHNlbGYuZGV2aWNlOgorICAgICAgICAgICAgIGRlc2MgKz0gIlxcbiVzIiAlIHNlbGYuZGV2 aWNlWydzdWJ0eXBlJ10KKyAKKy0gICAgICAgICMgZXNjYXBlICIsIGFuZCBcbiwgZm9yIGdudXBs b3QsIHRvIG5vdCBicmVhayBzdHJpbmdzCisrICAgICAgICAjIGVzY2FwZSAiLCBgLCBhbmQgXG4s IGZvciBnbnVwbG90LCB0byBub3QgYnJlYWsgc3RyaW5ncworICAgICAgICAgZGVzYyA9IGRlc2Mu cmVwbGFjZSgnIicsICdcXDA0MicpCisrICAgICAgICBkZXNjID0gZGVzYy5yZXBsYWNlKCdgJywg J1xcMTQwJykKKyAgICAgICAgIGRlc2MgPSBkZXNjLnJlcGxhY2UoJ1xuJywgJycpCisgCisgICAg ICAgICByZXR1cm4gZGVzYworQEAgLTEyNjgsOCArMTI2OSw5IEBAIGlmIF9fbmFtZV9fID09ICdf X21haW5fXyc6CisgICAgICAgICAgICAgb3B0aW9ucy50aXRsZSA9IHBsb3Qud2hhdGFtaSgpCisg ICAgICAgICBpZiBvcHRpb25zLnN1YnRpdGxlOgorICAgICAgICAgICAgIG9wdGlvbnMudGl0bGUg Kz0gJ1xcbicgKyBvcHRpb25zLnN1YnRpdGxlCistICAgICAgICAjIGVzY2FwZSAiIGZvciBnbnVw bG90LCB0byBub3QgYnJlYWsgc3RyaW5ncworKyAgICAgICAgIyBlc2NhcGUgIiwgIGFuZGAsIGZv ciBnbnVwbG90LCB0byBub3QgYnJlYWsgc3RyaW5ncworICAgICAgICAgb3B0aW9ucy50aXRsZSA9 IG9wdGlvbnMudGl0bGUucmVwbGFjZSgnIicsICdcXDA0MicpCisrICAgICAgICBvcHRpb25zLnRp dGxlID0gb3B0aW9ucy50aXRsZS5yZXBsYWNlKCciJywgJ1xcMTQwJykKKyAgICAgICAgIHRlcm1f b3B0cyA9ICIiCisgICAgICAgICB0cnVlY29sb3JfdGVybXMgPSBbJ3BuZycsICdzaXhlbGdkJywg J3d4dCddCisgICAgICAgICBpZiBvcHRpb25zLnRlcm1pbmFsIGluIHRydWVjb2xvcl90ZXJtczoK KworY29tbWl0IDRjMDY2NThlOTg4ZjRjZWQxYTdhNTc0Y2UwODJhMjJlZjYyNWRmNTYKK0F1dGhv cjogR2FyeSBFLiBNaWxsZXIgPGdlbUByZWxsaW0uY29tPgorRGF0ZTogICBUdWUgSnVsIDcgMTQ6 MjM6NTYgMjAyNiAtMDcwMAorCisgICAgY2xpZW50cy9ncHNwcm9mLnB5LmluOiBRdW90ZSBiYWNr IHRpY2tzIGluIHRpdGxlLgorICAgIAorICAgIFNlY29uZCB0cnkuICBBbHNvIHF1b3RlICJ0ZXJt aW5hbCIuCisgICAgCisgICAgU29tZW9uZSBjb3VsZCB1c2UgdGhlIGJhY2sgdGljayB0byBicmVh ayBvdXQgb2YgdGhlIHN0cmluZyBhbmQgYWRkCisgICAgZ251cGxvdCBjb21tbmRzLgorICAgIAor ICAgIEZvciBpc3N1ZSA0MDQuCisgICAgUmVwb3J0ZWQgYnk6IEN1QjN5MG5kLCBhbmQgV2FkZSBT cGFya3MgPHdzcGFya3NAdnVsbmNoZWNrLmNvbT4KKworZGlmZiAtLWdpdCBhL2NsaWVudHMvZ3Bz cHJvZi5weS5pbiBiL2NsaWVudHMvZ3BzcHJvZi5weS5pbgoraW5kZXggMjAyMjE0NzY5Li5lOTEz NjdlZTMgMTAwNjQ0CistLS0gYS9jbGllbnRzL2dwc3Byb2YucHkuaW4KKysrKyBiL2NsaWVudHMv Z3BzcHJvZi5weS5pbgorQEAgLTIwMCw3ICsyMDAsNyBAQCBjbGFzcyBwbG90dGVyKG9iamVjdCk6 CisgCisgICAgICAgICAjIGVzY2FwZSAiLCBgLCBhbmQgXG4sIGZvciBnbnVwbG90LCB0byBub3Qg YnJlYWsgc3RyaW5ncworICAgICAgICAgZGVzYyA9IGRlc2MucmVwbGFjZSgnIicsICdcXDA0Micp CistICAgICAgICBkZXNjID0gZGVzYy5yZXBsYWNlKCdgJywgJ1xcMTQwJykKKysgICAgICAgIGRl c2MgPSBkZXNjLnJlcGxhY2UoIlx4NjAiLCAnXFwxNDAnKQorICAgICAgICAgZGVzYyA9IGRlc2Mu cmVwbGFjZSgnXG4nLCAnJykKKyAKKyAgICAgICAgIHJldHVybiBkZXNjCitAQCAtMTI3MSwxMyAr MTI3MSwxOSBAQCBpZiBfX25hbWVfXyA9PSAnX19tYWluX18nOgorICAgICAgICAgICAgIG9wdGlv bnMudGl0bGUgKz0gJ1xcbicgKyBvcHRpb25zLnN1YnRpdGxlCisgICAgICAgICAjIGVzY2FwZSAi LCAgYW5kYCwgZm9yIGdudXBsb3QsIHRvIG5vdCBicmVhayBzdHJpbmdzCisgICAgICAgICBvcHRp b25zLnRpdGxlID0gb3B0aW9ucy50aXRsZS5yZXBsYWNlKCciJywgJ1xcMDQyJykKKy0gICAgICAg IG9wdGlvbnMudGl0bGUgPSBvcHRpb25zLnRpdGxlLnJlcGxhY2UoJyInLCAnXFwxNDAnKQorKyAg ICAgICAgb3B0aW9ucy50aXRsZSA9IG9wdGlvbnMudGl0bGUucmVwbGFjZSgiXHg2MCIsICdcXDE0 MCcpCisgICAgICAgICB0ZXJtX29wdHMgPSAiIgorICAgICAgICAgdHJ1ZWNvbG9yX3Rlcm1zID0g WydwbmcnLCAnc2l4ZWxnZCcsICd3eHQnXQorICAgICAgICAgaWYgb3B0aW9ucy50ZXJtaW5hbCBp biB0cnVlY29sb3JfdGVybXM6CisgICAgICAgICAgICAgdGVybV9vcHRzID0gJ3RydWVjb2xvcicK Ky0gICAgICAgIHN5cy5zdGRvdXQud3JpdGUoInNldCB0ZXJtaW5hbCAlcyBzaXplIDgwMCw5NTAg JXNcbiIKKy0gICAgICAgICAgICAgICAgICAgICAgICAgInNldCB0ZXJtb3B0aW9uIGVuaGFuY2Vk XG4iCisrCisrICAgICAgICAjIGVzY2FwZSAiLCBgLCBhbmQgXG4sIGZvciBnbnVwbG90LCB0byBu b3QgYnJlYWsgc3RyaW5ncworKyAgICAgICAgb3B0aW9ucy50ZXJtaW5hbCA9IG9wdGlvbnMudGVy bWluYWwucmVwbGFjZSgnIicsICdcXDA0MicpCisrICAgICAgICBvcHRpb25zLnRlcm1pbmFsID0g b3B0aW9ucy50ZXJtaW5hbC5yZXBsYWNlKCJceDYwIiwgJ1xcMTQwJykKKysgICAgICAgIG9wdGlv bnMudGVybWluYWwgPSBvcHRpb25zLnRlcm1pbmFsLnJlcGxhY2UoJ1xuJywgJycpCisrCisrICAg ICAgICBzeXMuc3Rkb3V0LndyaXRlKCdzZXQgdGVybWluYWwgIiVzIiBzaXplIDgwMCw5NTAgJXNc bicKKysgICAgICAgICAgICAgICAgICAgICAgICAgJ3NldCB0ZXJtb3B0aW9uIGVuaGFuY2VkXG4n CisgICAgICAgICAgICAgICAgICAgICAgICAgICUgKG9wdGlvbnMudGVybWluYWwsIHRlcm1fb3B0 cykpCisgICAgICAgICAjIGRvdWJsZSBxdW90ZXMgb24gdGl0bGUgc28gXG4gaXMgcGFyc2VkIGJ5 IGdudXBsb3QKKyAgICAgICAgIHN5cy5zdGRvdXQud3JpdGUoJ3NldCB0aXRsZSBub2VuaGFuY2Vk ICIlc1xcblxcbiJcbicgJSBvcHRpb25zLnRpdGxlKQoKZGlmZiAtLWdpdCBhL2dwc2Quc3BlYyBi L2dwc2Quc3BlYwppbmRleCAzZGE5YzhiLi5jYTZiYjBmIDEwMDY0NAotLS0gYS9ncHNkLnNwZWMK KysrIGIvZ3BzZC5zcGVjCkBAIC0zNCw2ICszNCw4IEBAIFNvdXJjZTExOiAgICAgICBncHNkLnN5 c2NvbmZpZwogCiAjIEFkZCBvbGQgc3RhdHVzIG5hbWVzIHRvIGdwcy5oIGZvciBjb21wYXRpYmls aXR5CiBQYXRjaDE6ICAgICAgICAgZ3BzZC1hcGlzdGF0dXMucGF0Y2gKKyMgRml4IGNvbW1hbmQg aW5qZWN0aW9uIGluIGdwc3Byb2YKK1BhdGNoMjogICAgICAgICBncHNkLWN2ZS0yMDI2LTU4NDU5 LnBhdGNoCiAKIEJ1aWxkUmVxdWlyZXM6ICBnY2MKIEJ1aWxkUmVxdWlyZXM6ICBkYnVzLWRldmVs Cg==