Hi Jonathan! Thanks!
One stupid question - how do I approach that same problem for gpsd in oldstable? There is one more CVE, that was handled for stable by Bastien Roucariès (rouca) in a NMU, so I am going to backport that patch too. I presume that I do not have to wait for something else to settle and will have to open another pu bug, but am not 100% sure... With best regards, b. On Sun, 2026-07-26 at 15:35 +0000, Jonathan Wiltshire wrote: > package release.debian.org > tags 1142786 = trixie pending > thanks > > Hi, > > The upload referenced by this bug report has been flagged for acceptance into > the proposed-updates queue for Debian trixie. > > Thanks for your contribution! > > Upload details > ============== > > Package: gpsd > Version: 3.25-5+deb13u2 > > Explanation: fix gpsprof command and code injection in gnuplot script > generation [CVE-2026-58459 CVE-2026-60122]
