Debian Patches

Status for freecad/0.20.2+dfsg1-4+deb12u1

Patch Description Author Forwarded Bugs Origin Last update
fix-occt-7.5.2.patch Fix builds for OpenCASCADE >= 7.5.2 Kurt Kremitzki <kkremitzki@debian.org> no
opencascade74.patch Fix break caused by hidden dependency on 3rd party library (OpenCASCADE) "using namespace std" Kurt Kremitzki <kkremitzki@debian.org> no
fix_gcc8_ftbfs.patch Fixes GCC8 FTBFS due to included copy of SMESH. Kurt Kremitzki <kurt@kwk.systems> no
fix_armel_FTBFS.patch fix compilation on Armel due to coincident variables in sys/ucontext.h (R2, R3, R4). Thanks to Paul Brook <paul@codesourcery.com>
http://lists.alioth.debian.org/pipermail/debian-science-maintainers/2011-October/009876.html		 Anton Gladky <gladky.anton@gmail.com> no 2011-10-27
fix-cmake-extra-license.patch Don't include extra license file in package Kurt Kremitzki <kkremitzki@gmail.com> no 2018-06-13
do_not_install_binary_examples.patch Do not include binary examples excluded via d/copyright Anton Gladky <gladk@debian.org> no 2018-06-10
exclude_ply.patch exclude ply from build-sources, use packaged version Anton Gladky <gladk@debian.org>, Sebastian Hoogen <sebastian@hoogen.de> no 2013-09-25
disable_memory_check.patch Disable memory-check in SMDS because sysinfo.h is not working on BSD-systems and causes FTBFS. It is better to disable it only on
BSD-platforms.
Or use http://code.google.com/p/sysinfo-bsd/source/browse/sysinfo.c
for them.		 Anton Gladky <gladky.anton@gmail.com> no debian 2011-09-24
python3.8-syntax.diff no
fix-s390x-test-fail-skip-load-old-file.patch Skip open_de9b3fb438 s390x to avoid OOM The load of the current file in test_open_head is fine, but
open_de9b3fb438 goes into an OOM even in huge (e.g. 10GB) systemd.
This probably needs a proper fix by upstream in regard to the migration
modules that load the old code, but until then (since the rest works on s390x)
this unblocks the package self-test in Debian & Ubuntu.		 Christian Ehrhardt <christian.ehrhardt@canonical.com> no debian <todo-URL-to-git or similar> 2021-03-15
run_single-instance.patch Single instance of application. Håvard Flaget Aasen <haavard_aasen@yahoo.no> no 2021-12-26
fix-1014875-arm-FTBFS.patch Fix FTBFS on armhf/armel, undefined GL_PROJECTION This define is defined in GL/gl.h, so there must be some missing include
somewhere. This patch just adds the include…		 tobi@debian.org no debian 2022-08-08
fix-1017598.patch Disable failing FEM test case TestSolverCalculix The upstream bug tracker suggests that this is a problem with the test, as it seems
floats for the input are very similiar, only differing by the LSB.
.
This patch disables the test.		 Tobias Frost <tobi@debian.org> not-needed debian upstream 2022-08-18
bug-993089-dxf-support-desktop-file.patch Add several supported MIME types to deskto file. Tobias Frost <tobi@debian.org> invalid debian 2022-09-11
numpy-1.24.patch Use int instead of deprecated `np.int` Kurt Kremitzki <kkremitzki@debian.org no 2023-01-23
CVE-2026-34789-1-81b73925.patch CVE-2026-34789: validate module imports in PropertyPythonObject::Restore() A crafted FCStd document could set the "module" attribute of a serialised
PropertyPythonObject to an arbitrary Python module name. On restore that name
was handed straight to PyImport_ImportModule(), so merely opening the document
executed the module-level code of any importable module. The legacy pickle
fallback branch was worse still: it imported an attacker-named module and then
invoked one of its attributes via PyObject_CallObject().
.
This introduces multi-stage validation of module imports when loading an FCStd
file:
.
1) Has the module already been loaded? If so, it's OK.
2) Is the module located in a known location? (e.g. Mod, Ext, etc.) OK.
3) Legacy modules that are now handled by a loader module that is in a
known location (for example, femobjects._FemElementGeometry2D) are OK.
.
If the module is outside these parameters it is rejected. The fallback Pickle
code for handling files from FreeCAD 0.12 and earlier is removed outright,
since it was itself a minor vulnerability.
src/App/PropertyPythonObject.cpp was reformatted and modernised between 1.0.0
and 1.1.x; the logic added here is a line-for-line reproduction of the upstream
helpers with the following deliberate divergences:
.
* C++17 compatibility. FreeCAD 1.0.0 builds with CMAKE_CXX_STANDARD 17 by
default (cMake/FreeCAD_Helpers/CompilerChecksAndSetups.cmake) and debian/rules
does not raise it, whereas 1.1.x builds with C++20. In isUnderDirectory() the
upstream C++20 constructs std::ranges::replace() and std::string::starts_with()
are therefore replaced by std::replace() and rfind(prefix, 0) == 0, which are
exactly equivalent. Everything else in the helper (the slash-collapsing lambda,
the trailing-slash normalisation) is unchanged.
.
* 1.0.0 API spellings. Base::XMLReader::getAttribute() is not yet a template in
1.0.0, so reader.getAttribute<const char*>("module") is written
reader.getAttribute("module"); Base::Console().warning() is Warning() and
Base::PyException::reportException() is ReportException().
.
* Brace/indent style follows the surrounding 1.0.0 code (which has not had
clang-format applied), so the single-statement if bodies in Restore() keep
their 1.0.0 form.
.
No upstream hunk was dropped: the anonymous-namespace helpers, the removal of
loadPickle() and of the pickle branch in Restore(), the removal of the
load_pickle flag, and the declaration removal in PropertyPythonObject.h are all
carried over. The upstream commit contains no tests. This is part 1 of 3: the
CVE-2026-34789 fix is only complete with CVE-2026-34789-2-e2dc6c81.patch and
CVE-2026-34789-3-526a4f0d.patch, and all three must travel together, because
applying this one alone leaves the import allowlist on an intermediate upstream
state that silently drops PropertyPythonObject data for classes living under
the macro directories.		 Chris Hennes <chennes@pioneerlibrarysystem.org> no backport, https://github.com/FreeCAD/FreeCAD/commit/81b73925ce22610542367301d8eff4259eb9596e 2026-09-29
CVE-2026-34789-2-e2dc6c81.patch App: Use __ModDirs__ as the authoritative list of mods to load from (#29068)

(cherry picked from commit 454db6ed438c19bdec7659b3ef7bf4213ace34da)		 Chris Hennes <chennes@gmail.com> no 2026-04-20
CVE-2026-34789-3-526a4f0d.patch CVE-2026-34789 part 3/3: Fix 30706: Allow Macro dirs as sources of PropertyPythonObject - Alt

This is the third and final part of the CVE-2026-34789 hardening and must be
applied together with CVE-2026-34789-1-81b73925.patch and
CVE-2026-34789-2-e2dc6c81.patch. Do not drop it as "not a security fix": it
repairs a user-visible regression that the first two patches introduce, and
without it the security fix lands on an intermediate upstream state that was
never released.

The import allowlist installed by parts 1 and 2 only accepts modules whose
origin lies under a directory listed in FreeCAD.__ModDirs__, and the macro
directories are not in that list. A PropertyPythonObject whose class lives in
a module under the user macro directory (App.getUserMacroDir(True)), the legacy
macro directory (App.getUserMacroDir(False)) or FreeCAD.getHomePath()+"Macro"
is therefore refused on restore: the property is restored as None and the only
feedback is a "blocked import of module ..." warning in the report view, so
opening and re-saving such a document silently discards data. This patch
exports those three directories as FreeCAD.__MacroDirs__ from FreeCADInit.py
and adds them to the allowlist consulted by isAllowedModule().

Fixes upstream issue 30706.

(cherry picked from commit d87781b80aada2c17d757de04b59b58266d227e9)

line has been prefixed with "CVE-2026-34789 part 3/3:" so the patch cannot be
mistaken for an unrelated bug fix, and the paragraphs above were added to the
commit message; the upstream subject text itself is otherwise unchanged. The
only edit to the diff is the retargeting of the two @@ hunk offsets, because
1.0.0 has fewer preceding lines in both files:
src/App/FreeCADInit.py 172 -> 150 and src/App/PropertyPythonObject.cpp
150 -> 151 (the latter counted against the state produced by parts 1 and 2).
Every context line and every added line is identical to upstream, including
the CRLF line endings both files carry, so "git show
526a4f0d78bb98ce554f4c1273f01f1f7eb63595" yields the same diff bodies. The
hunks contain no C++20 construct, so the C++17 substitutions that part 1
needed (std::replace for std::ranges::replace, rfind(p, 0) == 0 for
starts_with) have no counterpart here. The upstream commit contains no tests.		 Frank Martinez <mnesarco@gmail.com> no backport, https://github.com/FreeCAD/FreeCAD/commit/526a4f0d78bb98ce554f4c1273f01f1f7eb63595 2026-08-25
CVE-2026-73234.patch CVE-2026-73234: prevent directory traversal in included file PropertyFileIncluded::Restore() took the "file" and "data" attributes of a
<FileIncluded> element straight from Document.xml and concatenated them with
the document transient path without any validation. Directory components,
absolute paths and ".." sequences were all accepted, so a crafted .FCStd
archive could make FreeCAD write attacker-controlled content anywhere the
user running FreeCAD can write.
.
Save() always emits a bare basename (via FileInfo::fileName()), so any name
carrying a directory separator, an absolute path or a "."/".." reference is
by definition malicious. Reject those with a Base::FileException.
to upstream; only the surrounding context differs, because 1.0.0 still uses the
non-template Base::XMLReader::getAttribute("file") and the older
"Base::XMLReader &reader" formatting, and has three (not two) blank lines after
the "using namespace std;" block. The tests/src/App/CMakeLists.txt hunk had to be
hand-recreated: 1.0.0 registers the App unit tests through
"target_sources(Tests_run PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/<file>)" rather than
upstream's "add_executable(App_tests_run ...)" list, so the new source file is
added in that form instead. The new test file tests/src/App/PropertyFile.cpp is
taken from upstream with one deliberate change; every API it uses
(tests::initApplication() from InitApplication.h, App::VarSet,
PropertyContainer::addDynamicProperty(), Base::XMLReader(const char*,
std::istream&), Document::TransientDir) already exists in 1.0.0. 1.0.0 builds
with CMAKE_CXX_STANDARD 17, so the upstream C++20-only "#include <ranges>" and
"std::ranges::replace(transientDir, '\\', '/')" in the acceptsPlainBasename
test are dropped/replaced by
"std::replace(transientDir.begin(), transientDir.end(), '\\', '/')", which is
available in C++17 and behaves identically for this call; the upstream
"#include <algorithm>" line is kept unchanged since std::replace needs it too.
No hunks were dropped.		 Chris Hennes <chennes@pioneerlibrarysystem.org> no backport, https://github.com/FreeCAD/FreeCAD/commit/f19b18b7d93729a29a90e96e0ae192b5d054b86d 2026-08-25
CVE-2026-73235.patch CVE-2026-73235: harden FCStd Reader against XXE Base::XMLReader parses Document.xml from a .FCStd archive using a Xerces
SAX2 XMLReader without disabling external entity resolution or external DTD
loading. A crafted .FCStd whose Document.xml declares an external entity
(e.g. a DOCTYPE with a SYSTEM identifier using a "file:" or "http:" URI) can
therefore make Xerces read an arbitrary local file, or issue a
server-side HTTP(S) request, and have the resolved content delivered to
XMLReader::characters(), disclosing local files or enabling SSRF as soon as
the document is opened.
.
This sets fgXercesDisableDefaultEntityResolution and disables
fgXercesLoadExternalDTD on the parser so external entities and external DTDs
are no longer resolved.
byte-identical to upstream; only the hunk context differs, because 1.0.0
guards the include block with "#ifndef _PreComp_" / "#include <memory>" /
XMLReaderFactory.hpp, whereas upstream's tree at this commit has
"#include <string>" / XMLReaderFactory.hpp / Attributes.hpp with no PCH
guard, and the @@ line ranges were retargeted accordingly. The diff hunk
content lines below use CRLF line endings, matching src/Base/Reader.cpp on
disk; only the diff/hunk marker lines (diff --git, ---, +++, @@) use LF.
No hunks were dropped.		 Chris Hennes <chennes@pioneerlibrarysystem.org> no debian backport, https://github.com/FreeCAD/FreeCAD/commit/7d1b8f5806db578db99feb348e55a6b0eaff7c73 2026-08-25

All known versions for source package 'freecad'

Links