Debian Patches
Status for freecad/1.0.0+dfsg-8+deb13u3
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| 1100-run_single-instance.patch | Change XDG desktop entry to only run single instance of FreeCAD. This ensure invoking it to open different files only start the program once, and load new files into the already running instance. Related to https://bugs.debian.org/1029846 and https://github.com/FreeCAD/FreeCAD/commit/c7a21ecbeecefe7c2dfc9e950b3d6bb42351d476 . Partly applied upstream. Arguments applied, program name change is not. |
Håvard Flaget Aasen <haavard_aasen@yahoo.no> | yes | 2024-12-21 | ||
| 2000-do_not_install_binary_examples.patch | Do not include binary examples excluded via d/copyright | Anton Gladky <gladk@debian.org> | not-needed | 2018-06-10 | ||
| 2010-exclude_ply.patch | exclude ply from build-sources, use packaged version | Anton Gladky <gladk@debian.org>, Sebastian Hoogen <sebastian@hoogen.de> | not-needed | 2013-09-25 | ||
| 2020-fix-cmake-extra-license.patch | Don't include extra license file in package | Kurt Kremitzki <kkremitzki@debian.org> | not-needed | 2018-06-13 | ||
| 2040-ftbfs-macappbundle.patch | Do not cmake add_subdirectory on removed directory. Avoids a FTBFS. | Tobias Frost <tobi@debian.org> | not-needed | 2023-12-09 | ||
| 2060-fix-linking.patch | Fix FTBFS due to wrong link order, ensure GMock and GTest be found | Tobias Frost <tobi@debian.org> | not-needed | 2024-12-21 | ||
| 2070-use-nlohmann-json3-dev.patch | Use packaged json3 library. | Tobias Frost <tobi@debian.org> | no | 2024-12-23 | ||
| 1040-fix-cmake-race.patch | FTBFS on arm64 - race condition in CMakeLists.txt for Mod/Assembly Avoid race in Assembly file copying by removing overlap and enforcing target order. Ensure AssemblyScripts runs before AssemblyTests to guarantee directories exist. Fixes intermittent FTBFS on arm64. |
Tobias Frost <tobi@debian.org> | yes | 2026-04-23 | ||
| 1080-fix-FTBFS-due-dfsg-repacking-p1.patch | Fix FTBFS due to dfsg repacking - when the kuka files are gone, the Mod/Robot CMakeLists.txt will complain (note, this patch needs refactoring to be upstreamable.) |
Tobias Frost <tobi@debian.org> | yes | upstream | 2024-12-21 | |
| 1081-fix-FTBFS-due-dfsg-repacking-p2.patch | Fix FTBFS due to dfsg repacking - when Y14.5-2018.ttf (TechDraw Workbench.) is deleted, CMake will complain. note: upstream is clarifing font license, see https://github.com/FreeCAD/FreeCAD/issues/18622 |
Tobias Frost <tobi@debian.org> | invalid | 2024-12-21 | ||
| 1090-freecad-spelling-allow-one.patch | Spelling fixed found by linitian (Allow one to) | Tobias Frost <tobi@debian.org> | yes | upstream | 2024-12-24 | |
| 1091-freecad-spelling-others.patch | Spelling fixed found by linitian (Other fixes) Note: the fix for segments in salmonmesh is not upstreamable, see PR 18688. | Tobias Frost <tobi@debian.org> | yes | upstream | 2024-12-24 | |
| 1110-GL_MULTISAMPLE.patch | FTBFS on armel, armhf due to not defined GL_MULTISAMPLE | Tobias Frost <tobi@debian.org> | invalid | upstream | 2024-12-24 | |
| 2080-force-xcb-on-wayland.patch | Workaround for bug in src:coin3d (#1050302) causing a crash under Wayland FreeCAD crashes on Wayland due to Coin3D requiring a current GL context during initialization. Qt uses EGL on Wayland, which leads to missing context at that point. Forcing the X11 (xcb) backend avoids the issue by using the GLX path, which satisfies Coin3D's expectations. This is a temporary workaround until coin3d is updated. |
Tobias Frost <tobi@debian.org> | not-needed | debian upstream | 2025-06-28 | |
| 1100-cam-fanuc-post-fix.patch | fix fanuc postprocessor commit 13c8babc1a63e1a656fb6559bff90cff58954375 CAM: Correct Fanuc post processor to work properly. Fixes crash problem, milling, drilling, tool changes, thread tapping and get the post processor working as it should. This patch is tested on a Fanuc controller and sent upstream as <URL: https://github.com/FreeCAD/FreeCAD/pull/27960 > Closes: #1117850 diff --git a/src/Mod/CAM/Path/Post/scripts/fanuc_post.py b/src/Mod/CAM/Path/Post/scripts/fanuc_post.py index 2edc7abaf..15af728a1 100644 |
Petter Reinholdtsen <pere@hungry.com> | yes | debian upstream | https://github.com/FreeCAD/FreeCAD/pull/27964 | 2026-03-02 |
| CVE-2026-34398-CVE-2026-34399.patch | CVE-2026-34398, CVE-2026-34399: BIM: remove eval() on untrusted input The BIM workbench passed attacker-controlled strings straight to eval(), giving arbitrary Python code execution to anybody able to hand the victim a crafted file. . CVE-2026-34398 (GHSA-8rfj-7956-6gwf): bimcommands/BimProjectManager.py eval()s the "wpposition", "wpu", "wpv" and "wpaxis" Meta properties read from an FCStd project template. Loading a malicious template executes the payload. Replaced by a strict regexp-based Vector(x,y,z) parser. . CVE-2026-34399 (GHSA-chv4-vm6r-wjqj): bimcommands/BimTDPage.py eval()s the "Scale" editable-text field of an SVG TechDraw template as soon as it contains a "/". Replaced by an explicit split on "/" and two float() conversions. . The same commit also removes two further eval() uses on data that is not necessarily trusted: the colour columns of the layers manager (bimcommands/BimLayers.py, now ast.literal_eval()) and the IfcBoolean / IfcLogical property values in importers/exportIFC.py (now a plain string comparison). They are carried over as well because they are part of the same hardening. in 1.0.0 and all six eval() call sites are present, so no hunk was dropped. Divergences, all caused by 1.0.0 code that upstream had already reworked before the fix landed: . * BimProjectManager.py: 1.0.0 still uses the legacy FreeCAD.DraftWorkingPlane singleton guarded by hasattr(FreeCAD, "DraftWorkingPlane"), not WorkingPlane.get_working_plane(), and it has no wp._handle_custom() call. The upstream rewrite into a (key, attribute) loop is therefore not applicable; the four assignments were kept in place and only eval() was swapped for the new _parse_vector() helper, which is taken verbatim from upstream. This deliberately preserves 1.0.0's pre-existing 'if "wppos" in values' typo (upstream's loop silently changes that key to "wpposition"); fixing it is a behaviour change unrelated to the vulnerability, and the eval() is removed either way. The now-unused 'from FreeCAD import Vector' import is dropped, as upstream does. . * BimLayers.py: 1.0.0 imports os before FreeCAD, so 'import ast' is added at the top of that same block instead of in a separate group. . * exportIFC.py: 1.0.0 predates the black reformatting of this file, so the surrounding context differs in whitespace only; the change itself is identical to upstream. . The upstream commit contains no test hunks, so none had to be adapted. . Behaviour changes carried over unmodified from upstream (not porting artefacts of this backport): . * BimTDPage.py: 'if ":" in val: val.replace(":", "/")' becomes 'val = val.replace(":", "/")'. The original was a no-op (str.replace() returns a new string rather than mutating val), so a template scale of "1:100" never reached the "/" branch and was silently ignored; it is now honoured as 0.01. This is upstream's intent, not a porting artefact. * BimTDPage.py: the bare 'except:' clauses become 'except (ValueError, ZeroDivisionError)' and 'except ValueError', so exceptions raised by 'page.Scale = ...' other than those now propagate instead of being silently swallowed. * BimProjectManager.py: _parse_vector() raises ValueError, and the four call sites in loadTemplate() do not catch it, so a template whose Meta holds a malformed 'wp*' string now aborts template loading instead of silently misbehaving. Upstream has the identical property. Values that FreeCAD itself writes (e.g. "Vector (0.0, 0.0, 0.0)") are accepted by the regexp, so ordinary templates are unaffected. |
Chris Hennes <chennes@pioneerlibrarysystem.org> | no | backport, https://github.com/FreeCAD/FreeCAD/commit/9ed351cc4700db0a94c46f020c34c58bbf1bdaba | 2026-08-25 | |
| CVE-2026-34789-1-81b73925.patch | CVE-2026-34789: validate module imports in PropertyPythonObject::Restore() A crafted FCStd document could set the "module" attribute of a serialised PropertyPythonObject to an arbitrary Python module name. On restore that name was handed straight to PyImport_ImportModule(), so merely opening the document executed the module-level code of any importable module. The legacy pickle fallback branch was worse still: it imported an attacker-named module and then invoked one of its attributes via PyObject_CallObject(). . This introduces multi-stage validation of module imports when loading an FCStd file: . 1) Has the module already been loaded? If so, it's OK. 2) Is the module located in a known location? (e.g. Mod, Ext, etc.) OK. 3) Legacy modules that are now handled by a loader module that is in a known location (for example, femobjects._FemElementGeometry2D) are OK. . If the module is outside these parameters it is rejected. The fallback Pickle code for handling files from FreeCAD 0.12 and earlier is removed outright, since it was itself a minor vulnerability. src/App/PropertyPythonObject.cpp was reformatted and modernised between 1.0.0 and 1.1.x; the logic added here is a line-for-line reproduction of the upstream helpers with the following deliberate divergences: . * C++17 compatibility. FreeCAD 1.0.0 builds with CMAKE_CXX_STANDARD 17 by default (cMake/FreeCAD_Helpers/CompilerChecksAndSetups.cmake) and debian/rules does not raise it, whereas 1.1.x builds with C++20. In isUnderDirectory() the upstream C++20 constructs std::ranges::replace() and std::string::starts_with() are therefore replaced by std::replace() and rfind(prefix, 0) == 0, which are exactly equivalent. Everything else in the helper (the slash-collapsing lambda, the trailing-slash normalisation) is unchanged. . * 1.0.0 API spellings. Base::XMLReader::getAttribute() is not yet a template in 1.0.0, so reader.getAttribute<const char*>("module") is written reader.getAttribute("module"); Base::Console().warning() is Warning() and Base::PyException::reportException() is ReportException(). . * Brace/indent style follows the surrounding 1.0.0 code (which has not had clang-format applied), so the single-statement if bodies in Restore() keep their 1.0.0 form. . No upstream hunk was dropped: the anonymous-namespace helpers, the removal of loadPickle() and of the pickle branch in Restore(), the removal of the load_pickle flag, and the declaration removal in PropertyPythonObject.h are all carried over. The upstream commit contains no tests. This is part 1 of 3: the CVE-2026-34789 fix is only complete with CVE-2026-34789-2-e2dc6c81.patch and CVE-2026-34789-3-526a4f0d.patch, and all three must travel together, because applying this one alone leaves the import allowlist on an intermediate upstream state that silently drops PropertyPythonObject data for classes living under the macro directories. |
Chris Hennes <chennes@pioneerlibrarysystem.org> | no | backport, https://github.com/FreeCAD/FreeCAD/commit/81b73925ce22610542367301d8eff4259eb9596e | 2026-08-25 | |
| CVE-2026-34789-2-e2dc6c81.patch | App: Use __ModDirs__ as the authoritative list of mods to load from (#29068) (cherry picked from commit 454db6ed438c19bdec7659b3ef7bf4213ace34da) |
Chris Hennes <chennes@gmail.com> | no | 2026-04-20 | ||
| CVE-2026-34789-3-526a4f0d.patch | CVE-2026-34789 part 3/3: Fix 30706: Allow Macro dirs as sources of PropertyPythonObject - Alt This is the third and final part of the CVE-2026-34789 hardening and must be applied together with CVE-2026-34789-1-81b73925.patch and CVE-2026-34789-2-e2dc6c81.patch. Do not drop it as "not a security fix": it repairs a user-visible regression that the first two patches introduce, and without it the security fix lands on an intermediate upstream state that was never released. The import allowlist installed by parts 1 and 2 only accepts modules whose origin lies under a directory listed in FreeCAD.__ModDirs__, and the macro directories are not in that list. A PropertyPythonObject whose class lives in a module under the user macro directory (App.getUserMacroDir(True)), the legacy macro directory (App.getUserMacroDir(False)) or FreeCAD.getHomePath()+"Macro" is therefore refused on restore: the property is restored as None and the only feedback is a "blocked import of module ..." warning in the report view, so opening and re-saving such a document silently discards data. This patch exports those three directories as FreeCAD.__MacroDirs__ from FreeCADInit.py and adds them to the allowlist consulted by isAllowedModule(). Fixes upstream issue 30706. (cherry picked from commit d87781b80aada2c17d757de04b59b58266d227e9) line has been prefixed with "CVE-2026-34789 part 3/3:" so the patch cannot be mistaken for an unrelated bug fix, and the paragraphs above were added to the commit message; the upstream subject text itself is otherwise unchanged. The only edit to the diff is the retargeting of the two @@ hunk offsets, because 1.0.0 has fewer preceding lines in both files: src/App/FreeCADInit.py 172 -> 150 and src/App/PropertyPythonObject.cpp 150 -> 151 (the latter counted against the state produced by parts 1 and 2). Every context line and every added line is identical to upstream, including the CRLF line endings both files carry, so "git show 526a4f0d78bb98ce554f4c1273f01f1f7eb63595" yields the same diff bodies. The hunks contain no C++20 construct, so the C++17 substitutions that part 1 needed (std::replace for std::ranges::replace, rfind(p, 0) == 0 for starts_with) have no counterpart here. The upstream commit contains no tests. |
Frank Martinez <mnesarco@gmail.com> | no | backport, https://github.com/FreeCAD/FreeCAD/commit/526a4f0d78bb98ce554f4c1273f01f1f7eb63595 | 2026-08-25 | |
| CVE-2026-73233.patch | CVE-2026-73233: FEM: Switch to direct C++ set of text values The FEM Displacement Constraint task dialog interpolated the user-supplied displacement formula strings into a Python command string that was then executed via Gui::Command::doCommand(). The escaping helpers (get_xFormula()/get_yFormula()/get_zFormula()) only escaped double quotes and left backslashes untouched, so a formula ending in a backslash (or containing \" sequences) escapes the generated Python string literal and injects arbitrary Python that runs with FreeCAD's privileges as soon as the user accepts the dialog. . This drops the broken escaping and stops round-tripping the free-form text through generated Python: the three *DisplacementFormula properties are now set directly on the C++ object, which cannot be escaped out of. because src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp was reformatted wholesale after 1.0.0 (upstream 25c3ba7338 "All: Reformat according to new standard") and because 1.0.0 still writes QString::fromLatin1("...") where 1.1.x uses QStringLiteral("..."). The change is therefore re-applied by hand against 1.0.0's formatting; the content is semantically identical to upstream, with no dropped hunks, though it is not hunk for hunk: upstream 3f60d202a8 has 3 unified hunks, this backport has 2, because upstream's hunk 2 (adding the constraint pointer) and hunk 3 (the doCommand replacements) are adjacent in 1.0.0's layout and merge into one hunk under diff's context overlap: . * get_xFormula()/get_yFormula()/get_zFormula() return the line-edit text verbatim instead of quote-escaping it; * TaskDlgFemConstraintDisplacement::accept() obtains the Fem::ConstraintDisplacement* (the header is already included in 1.0.0) and calls xDisplacementFormula.setValue() / yDisplacementFormula / zDisplacementFormula directly instead of issuing doCommand(). . Cosmetic divergences from upstream, content otherwise unchanged: . * upstream declares the constraint pointer as 'auto* constraint = ...' on one line; this backport spells out the type as an explicit two-line 'Fem::ConstraintDisplacement* constraint = ...' declaration instead of using 'auto*'. . The Gui::Command/doCommand API is unchanged between 1.0.0 and 1.1.2, and the direct-property-set idiom used here is already the established idiom in 1.0.0 (e.g. src/Mod/Fem/Gui/TaskFemConstraintHeatflux.cpp, TaskFemConstraintBearing.cpp), so no new API is pulled in. The remaining doCommand() calls are left alone: they interpolate only Quantity::getSafeUserString() output and hard-coded True/False, which are not attacker-controlled free-form text. The upstream commit carries no tests. . Behaviour change to be aware of: the formula assignments no longer appear in the Python console / macro recording, exactly as upstream. |
Chris Hennes <chennes@pioneerlibrarysystem.org> | no | debian | backport, https://github.com/FreeCAD/FreeCAD/commit/3f60d202a8246958232e2fbc74ba38a83483b74e | 2026-08-25 |
| CVE-2026-73235.patch | CVE-2026-73235: harden FCStd Reader against XXE Base::XMLReader parses Document.xml from a .FCStd archive using a Xerces SAX2 XMLReader without disabling external entity resolution or external DTD loading. A crafted .FCStd whose Document.xml declares an external entity (e.g. a DOCTYPE with a SYSTEM identifier using a "file:" or "http:" URI) can therefore make Xerces read an arbitrary local file, or issue a server-side HTTP(S) request, and have the resolved content delivered to XMLReader::characters(), disclosing local files or enabling SSRF as soon as the document is opened. . This sets fgXercesDisableDefaultEntityResolution and disables fgXercesLoadExternalDTD on the parser so external entities and external DTDs are no longer resolved. byte-identical to upstream; only the hunk context differs, because 1.0.0 guards the include block with "#ifndef _PreComp_" / "#include <memory>" / XMLReaderFactory.hpp, whereas upstream's tree at this commit has "#include <string>" / XMLReaderFactory.hpp / Attributes.hpp with no PCH guard, and the @@ line ranges were retargeted accordingly. The diff hunk content lines below use CRLF line endings, matching src/Base/Reader.cpp on disk; only the diff/hunk marker lines (diff --git, ---, +++, @@) use LF. No hunks were dropped. |
Chris Hennes <chennes@pioneerlibrarysystem.org> | no | debian | backport, https://github.com/FreeCAD/FreeCAD/commit/7d1b8f5806db578db99feb348e55a6b0eaff7c73 | 2026-08-25 |
| CVE-2026-73234.patch | CVE-2026-73234: prevent directory traversal in included file PropertyFileIncluded::Restore() took the "file" and "data" attributes of a <FileIncluded> element straight from Document.xml and concatenated them with the document transient path without any validation. Directory components, absolute paths and ".." sequences were all accepted, so a crafted .FCStd archive could make FreeCAD write attacker-controlled content anywhere the user running FreeCAD can write. . Save() always emits a bare basename (via FileInfo::fileName()), so any name carrying a directory separator, an absolute path or a "."/".." reference is by definition malicious. Reject those with a Base::FileException. to upstream; only the surrounding context differs, because 1.0.0 still uses the non-template Base::XMLReader::getAttribute("file") and the older "Base::XMLReader &reader" formatting, and has three (not two) blank lines after the "using namespace std;" block. The tests/src/App/CMakeLists.txt hunk had to be hand-recreated: 1.0.0 registers the App unit tests through "target_sources(Tests_run PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/<file>)" rather than upstream's "add_executable(App_tests_run ...)" list, so the new source file is added in that form instead. The new test file tests/src/App/PropertyFile.cpp is taken from upstream with one deliberate change; every API it uses (tests::initApplication() from InitApplication.h, App::VarSet, PropertyContainer::addDynamicProperty(), Base::XMLReader(const char*, std::istream&), Document::TransientDir) already exists in 1.0.0. 1.0.0 builds with CMAKE_CXX_STANDARD 17, so the upstream C++20-only "#include <ranges>" and "std::ranges::replace(transientDir, '\\', '/')" in the acceptsPlainBasename test are dropped/replaced by "std::replace(transientDir.begin(), transientDir.end(), '\\', '/')", which is available in C++17 and behaves identically for this call; the upstream "#include <algorithm>" line is kept unchanged since std::replace needs it too. No hunks were dropped. |
Chris Hennes <chennes@pioneerlibrarysystem.org> | no | backport, https://github.com/FreeCAD/FreeCAD/commit/f19b18b7d93729a29a90e96e0ae192b5d054b86d | 2026-08-25 |
All known versions for source package 'freecad'
- 1.1.3+dfsg-3 (sid)
- 1.0.0+dfsg-8+deb13u3 (trixie-security)
- 1.0.0+dfsg-8+deb13u2 (trixie)
- 0.20.2+dfsg1-4 (bookworm)