-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 02 Nov 2026 14:41:34 +0100
Source: apt
Binary: apt apt-dbgsym apt-utils apt-utils-dbgsym libapt-pkg-dev libapt-pkg7.0 libapt-pkg7.0-dbgsym
Architecture: armel
Version: 3.0.4
Distribution: trixie-security
Urgency: medium
Maintainer: armel Build Daemon (arm-ubc-04) <buildd_arm64-arm-ubc-04@buildd.debian.org>
Changed-By: Julian Andres Klode <jak@debian.org>
Description:
 apt        - commandline package manager
 apt-utils  - package management related utility programs
 libapt-pkg-dev - development files for APT's libapt-pkg and libapt-inst
 libapt-pkg7.0 - package management runtime library
Closes: 1111554
Changes:
 apt (3.0.4) trixie-security; urgency=medium
 .
   * SECURITY UPDATE: Download verification bypass
     - methods/*.cc: Open target files exclusively
     - CVE-2026-109518
   * SECURITY UPDATE: Out-of-bounds accesses
     - deb: guard against unsigned underflow when trimming control newlines
     - gpgv: don't advance past the null terminator in PushEntryWithKeyID
     - debDebFileParser: reject .deb without a Version field
     - srvrec: reject res_query answers bigger than our buffer
     - tagfile: fix unbounded backward scan in Fill()'s trailing-newline check
     - solver: Ensure workLess is a strict weak ordering
   * Memory exhaustion during download
     - Move "Tried to start delayed item […], but failed" to debugging
      (Closes: #1111554)
   * Test suite reliability:
     - test: Limit valgrind to 1024 open files
     - .gitlab-ci.yml: Point at debian:trixie
Checksums-Sha1:
 bb8e945d0641e39efc9c0e49d67eefaa4e258bc4 8533804 apt-dbgsym_3.0.4_armel.deb
 d055526621eed4d1bcbdd2bd271b17a55a0cd84e 1690436 apt-utils-dbgsym_3.0.4_armel.deb
 29711891611e9c053fb70ba93a3886a4983d1b22 307348 apt-utils_3.0.4_armel.deb
 802c3814daa49eea6614e2b4e8199ddaf38d6b10 9395 apt_3.0.4_armel-buildd.buildinfo
 727c44874fe9ddf0578001c280ca42b8dbcec05e 1347832 apt_3.0.4_armel.deb
 723491345082abb71d956ed14a85546530b8ae61 135392 libapt-pkg-dev_3.0.4_armel.deb
 debd577dd80524194f8b84e97b519386377ff42f 12258936 libapt-pkg7.0-dbgsym_3.0.4_armel.deb
 29e671a2c3eb6ff70c9b1e181072df217fd8716d 946640 libapt-pkg7.0_3.0.4_armel.deb
Checksums-Sha256:
 f8a2089cadf8f1c2beea3366a0e0403cb09519e56318a6890fe389c6a79dea0b 8533804 apt-dbgsym_3.0.4_armel.deb
 725344e78d6f6b3a6de57bc9bbcfcadcef334a249389e29d4020149b4c29af5d 1690436 apt-utils-dbgsym_3.0.4_armel.deb
 6586c19a0360c34895b2efee570ea70c995e01f022e2c587e60c374aa74096db 307348 apt-utils_3.0.4_armel.deb
 4c4f55fd92fdd335c69d04ca0ef7d69fcf45115402c8df814aabe23ac72dab0c 9395 apt_3.0.4_armel-buildd.buildinfo
 69a3118b3e64a41fce803e10c47f460c9a6b963fee2c24aa15559e0c6475f76c 1347832 apt_3.0.4_armel.deb
 a3d1f6b7279732af0e9f252fc788184428ff0bc3319215b45a43c858cde04c70 135392 libapt-pkg-dev_3.0.4_armel.deb
 c348c55f48480dbc5f8f0d05155045be3ac0c7c5ca59e11d20b24ca644c3906a 12258936 libapt-pkg7.0-dbgsym_3.0.4_armel.deb
 bb57cf2541f837d202bdc22675c310a37fc0cf8453248a7dadd41d1a23dfd1dd 946640 libapt-pkg7.0_3.0.4_armel.deb
Files:
 0d5d4e6ac2c7492c01f976fdfc4b9652 8533804 debug optional apt-dbgsym_3.0.4_armel.deb
 a683f1133ceeab2df458bbd7ec32f75f 1690436 debug optional apt-utils-dbgsym_3.0.4_armel.deb
 8b56ef6826049187c716da75db7054d9 307348 admin required apt-utils_3.0.4_armel.deb
 fbed54a8653f9456725f0178f4137ada 9395 admin required apt_3.0.4_armel-buildd.buildinfo
 f8c256b1fc8974086204479345b3ca18 1347832 admin required apt_3.0.4_armel.deb
 802f5e2e881bb3301a112dc0d8f643d5 135392 libdevel optional libapt-pkg-dev_3.0.4_armel.deb
 4a1cdc2ea09f171791f9a2de04b87d06 12258936 debug optional libapt-pkg7.0-dbgsym_3.0.4_armel.deb
 04b50f9a8d790baa6136e621a4ca1079 946640 libs optional libapt-pkg7.0_3.0.4_armel.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEECx5fXZYVNP9tMtwlK1PZBedPspoFAmro0gsACgkQK1PZBedP
sppsVw//S4GOhhsl3JWgi5B1gYY7Mh6kH0Z66s3itLKwrJ5rgeElRo943oMN/pMA
AmQRCFL10VyDUkpQeXK+7XxtJsXOp+w0j/cWkWZeMBfu+eSUWIJxJw3LsBqbfUqO
xw6q7DjmJhA8okYYAjTCU0nP4niy/3pxQ03UWOVOg5Yr86jlckWwxlJZh/q9E7iv
0WO3zhUehwkczEzXnwEEXrfA3Ckfc8G89fQcHeswxydubG2QQ6hZbcZEEoi+7ehF
OOSUJ9Cij5F7Nz079RsP3JZo5T3INtFungyjBqssdBKjBmgb5vNM6Zl9/RD09Ct2
NFrz+YqWVePZ0gCxSQlE1w8BgbnvaC3SMaVj7xcEBAuPppshzNpN6u2be5pGLp8y
5DuxptCQM1z5+rkMi9iOo+i2IaEwQuTv1giNYBHrxQyIulLA7+jEG3dnk6QxLybU
OT0tUzrBn36QbHTsLpCJ932BVT1GPk+Lh4MS0P5hgSHlU5eGNbVjSxe1T8jXosIi
sBRTMNIgzf3hmtpeZ7LzftHVgxNg9a1BbrUl4GzPLblwK7XImx8gLNbIV9xSbYS9
4+Bi8mRMt5GwJc1P5kl4zMYj+8ubgeMNkAjTVagCX6eNSazbLbgHeO8lDHL+BqrS
5UuY+XSFQqHmuzPaUbZaFfakJvEa039xBAIY+MRvKeAXaO5Wy/s=
=zYSr
-----END PGP SIGNATURE-----