gpsd (3.27.5-3) unstable; urgency=medium

  * Add an upstream patch to partially revert the ntpshm.h time_t
    changes, fixing the SHM interface on 32-bit systems with 64-bit
    time_t like armhf (Closes: #1140603)

 -- Boian Bonev <bbonev@ipacct.com>  Thu, 13 Aug 2026 18:01:36 +0000

gpsd (3.27.5-2) unstable; urgency=medium

  * Refresh patches
  * Add a patch to teach SConscript to detect Hurd

 -- Boian Bonev <bbonev@ipacct.com>  Tue, 04 Aug 2026 05:09:25 +0000

gpsd (3.27.5-1) unstable; urgency=medium

  * Fix CVE-2026-58459 (Closes: #1141962). A command injection
    vulnerability exists in the gpsprof client. The subtype field,
    sourced from a DEVICES JSON log entry or an NMEA PGRMT sentence, is
    written into the generated gnuplot program via a set title statement
    with only double quote characters escaped. An attacker who controls
    the GPS device subtype can embed backtick payloads and execute
    arbitrary shell commands as the user running gnuplot when the
    generated plot is rendered.
  * Fix CVE-2026-60122. A code injection vulnerability exists in the
    gpsprof client. The SKY.satellites[].used field is inserted
    unsanitized into a gnuplot heredoc data block. An attacker who
    controls the GPS input data can supply a used value containing the
    string EOD to terminate the heredoc early and append gnuplot
    system() calls, achieving OS command execution as the user running
    gpsprof when the generated plot script is processed by gnuplot in
    polar mode.
  * Bump standards to 4.7.4, no changes
  * Bump dh to 14
  * Remove redundant prio

 -- Boian Bonev <bbonev@ipacct.com>  Sat, 25 Jul 2026 21:16:01 +0000

gpsd (3.27.5-0.1) unstable; urgency=medium

  * Non-maintainer upload
  * New upstream version
  * Fix CVE-2025-67268 (Closes: #1124800).
    gpsd contains a heap-based out-of-bounds write
    vulnerability in the drivers/driver_nmea2000.c file.
    The hnd_129540 function, which handles NMEA2000 PGN 129540
    (GNSS Satellites in View) packets, fails to validate the
    user-supplied satellite count against the size of the skyview
    array (184 elements). This allows an attacker to write beyond
    the bounds of the array by providing a satellite count up
    to 255, leading to memory corruption, Denial of Service (DoS),
    and potentially arbitrary code execution.
  * Fix CVE-2025-67269 (Closes: #1124799).
    An integer underflow vulnerability exists in the `nextstate()`
    function in `gpsd/packet.c`.
    When parsing a NAVCOM packet, the payload length is calculated
    using `lexer->length = (size_t)c - 4` without checking if
    the input byte `c` is less than 4. This results in an unsigned
    integer underflow, setting `lexer->length` to a very large value
    (near `SIZE_MAX`). The parser then enters a loop attempting to
    consume this massive number of bytes, causing 100% CPU utilization
    and a Denial of Service (DoS) condition.

 -- Bastien Roucariès <rouca@debian.org>  Sat, 17 Jan 2026 16:47:06 +0100

gpsd (3.27-1.1) unstable; urgency=medium

  * Non-maintainer upload
  * Move to unstable

 -- Bastian Germann <bage@debian.org>  Thu, 27 Nov 2025 11:01:50 +0100

gpsd (3.27-1) experimental; urgency=medium

  * New upstream version 3.27

 -- Boian Bonev <bbonev@ipacct.com>  Tue, 25 Nov 2025 20:07:05 +0000

gpsd (3.26.1-1) unstable; urgency=medium

  [ наб ]
  * Remove dh-buildinfo

  [ Boian Bonev ]
  * Add patch from Alexander Inyukhin
    <shurick@sectorb.msk.ru> (Closes: #1063331)
  * New upstream version 3.26.1
  * Refresh patches and remove the bits applied upstream
  * Remove Rules-Requires-Root: no
  * Complete the t64 transition
  * Update shared library symbols
  * Add BD: ruby-rouge for asciidoctor
  * Update d/watch to v5
  * Bump standards to 4.7.2, no changes

 -- Boian Bonev <bbonev@ipacct.com>  Tue, 04 Nov 2025 21:28:21 +0000

gpsd (3.25-5) unstable; urgency=medium

  * Fix apparmor profile to work on usrmerged systems too (Closes: #1093437)
  * Add build-dep on python3-setuptools (Closes: #1080885)
  * Bump standards to 4.7.0, no changes
  * Remove the unused lintian overrides
  * Update debian copyright year

 -- Boian Bonev <bbonev@ipacct.com>  Sun, 19 Jan 2025 16:06:33 +0000

gpsd (3.25-4) unstable; urgency=medium

  * Mark strlcat/strlcpy as MISSING in .sybmols (Closes: #1071311)

 -- Boian Bonev <bbonev@ipacct.com>  Thu, 23 May 2024 20:36:33 +0000

gpsd (3.25-3) unstable; urgency=medium

  * Upload to unstable (Closes: #1063318)
  * Change build-dep on dpkg-dev to avoid bad backports
  * wrap-and-sort control files
  * Remove makedev from build-dep (Closes: #986713)
  * Install systemd service files in /usr (Closes: #1059185)

 -- Boian Bonev <bbonev@ipacct.com>  Wed, 28 Feb 2024 16:16:30 +0000

gpsd (3.25-3~exp1) experimental; urgency=medium

  * Fix a typo in d/rules
  * Convert lintian overrides to templates
  * Fix a typo in lintian overrides
  * Replace obsolete pkg-config w/ pkgconf
  * Update copyright years

 -- Boian Bonev <bbonev@ipacct.com>  Sun, 11 Feb 2024 13:30:56 +0000

gpsd (3.25-2.1) experimental; urgency=medium

  * Non-maintainer upload.
  * Rename libraries for 64-bit time_t transition.

 -- Steve Langasek <vorlon@debian.org>  Tue, 06 Feb 2024 05:50:03 +0000

gpsd (3.25-2) unstable; urgency=medium

  [ Boian Bonev ]
  * Refresh patches
  * Fix the second instance of 067b:2303 (Closes: #884744, LP: #2012207)

  [ Adrian Bunk ]
  * Don't build depend on python3-gps

 -- Boian Bonev <bbonev@ipacct.com>  Mon, 11 Sep 2023 15:47:57 +0000

gpsd (3.25-1) unstable; urgency=medium

  * Upload to sid

 -- Boian Bonev <bbonev@ipacct.com>  Wed, 28 Jun 2023 21:37:43 +0000

gpsd (3.25-1~exp2) experimental; urgency=medium

  * Add patch for upstream fix for build on Hurd

 -- Boian Bonev <bbonev@ipacct.com>  Sat, 24 Jun 2023 19:59:21 +0000

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libgps32`.
