-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 02 Nov 2026 14:41:34 +0100
Source: apt
Binary: apt apt-dbgsym apt-utils apt-utils-dbgsym libapt-pkg-dev libapt-pkg7.0 libapt-pkg7.0-dbgsym
Architecture: amd64
Version: 3.0.4
Distribution: trixie-security
Urgency: medium
Maintainer: all / amd64 / i386 Build Daemon (x86-conova-01) <buildd_amd64-x86-conova-01@buildd.debian.org>
Changed-By: Julian Andres Klode <jak@debian.org>
Description:
 apt        - commandline package manager
 apt-utils  - package management related utility programs
 libapt-pkg-dev - development files for APT's libapt-pkg and libapt-inst
 libapt-pkg7.0 - package management runtime library
Closes: 1111554
Changes:
 apt (3.0.4) trixie-security; urgency=medium
 .
   * SECURITY UPDATE: Download verification bypass
     - methods/*.cc: Open target files exclusively
     - CVE-2026-109518
   * SECURITY UPDATE: Out-of-bounds accesses
     - deb: guard against unsigned underflow when trimming control newlines
     - gpgv: don't advance past the null terminator in PushEntryWithKeyID
     - debDebFileParser: reject .deb without a Version field
     - srvrec: reject res_query answers bigger than our buffer
     - tagfile: fix unbounded backward scan in Fill()'s trailing-newline check
     - solver: Ensure workLess is a strict weak ordering
   * Memory exhaustion during download
     - Move "Tried to start delayed item […], but failed" to debugging
      (Closes: #1111554)
   * Test suite reliability:
     - test: Limit valgrind to 1024 open files
     - .gitlab-ci.yml: Point at debian:trixie
Checksums-Sha1:
 731b2a78ef378344838e5fe3455e2ba21002357b 9026868 apt-dbgsym_3.0.4_amd64.deb
 b06992b39b124e28336761cd34bb17975fd5f16c 1767864 apt-utils-dbgsym_3.0.4_amd64.deb
 a14325675e90e0789babb77030cffb89786754fb 336868 apt-utils_3.0.4_amd64.deb
 52fae2687644824a442d046c4b0dc83f95732b2e 9546 apt_3.0.4_amd64-buildd.buildinfo
 36cf89438b23e8e573f051c1d1b75bb1e60930a1 1453228 apt_3.0.4_amd64.deb
 790bb3f4d24cf935650fb72c89a4b94ed6dad960 135392 libapt-pkg-dev_3.0.4_amd64.deb
 a2015ba3e6815ee4945c3f4ff8df1f7aafbebea1 12753440 libapt-pkg7.0-dbgsym_3.0.4_amd64.deb
 f10f9c5f6525bb96bec57dbc3cdc6987af0832ac 1113872 libapt-pkg7.0_3.0.4_amd64.deb
Checksums-Sha256:
 877664f3b6b21c1385f3023bfe1850db8f4fa1950f7a9ddda54d8bd738ed2b84 9026868 apt-dbgsym_3.0.4_amd64.deb
 b586e88df1d4ec7f0e3361517b0a577fec3df79e565ff71bdcf799fae658bb9f 1767864 apt-utils-dbgsym_3.0.4_amd64.deb
 a77b3af564bb5143e7babb6aa6b098c6426be56b3811623748afc700a0af0e8c 336868 apt-utils_3.0.4_amd64.deb
 85d69983573277bb424cfd1effb488f186f1f50d0ea16a455894c2869baf2a52 9546 apt_3.0.4_amd64-buildd.buildinfo
 15c2030e0fb46580af4f1b4cc303f4bd26da781b004e99763bc9eff7cf8e19b8 1453228 apt_3.0.4_amd64.deb
 28e164b488a1b8a754f915a43af5d9cd119b57ecf5d6ee2cb6b4d9c5cababa6c 135392 libapt-pkg-dev_3.0.4_amd64.deb
 11610b99096b91090b1d742abe7fce9b13f1094a9e54e592f682c67f8a48a7c4 12753440 libapt-pkg7.0-dbgsym_3.0.4_amd64.deb
 577eb8f489de419290102364892dbd13ca256297b61f96d61b114fd4ac18be41 1113872 libapt-pkg7.0_3.0.4_amd64.deb
Files:
 2ea3431e9daac0506b6cc276584ce507 9026868 debug optional apt-dbgsym_3.0.4_amd64.deb
 fb73a61ceb8f0bce9e7e197dcea4af6f 1767864 debug optional apt-utils-dbgsym_3.0.4_amd64.deb
 07abb13db6bd5d7dfd1889b82f1790e6 336868 admin required apt-utils_3.0.4_amd64.deb
 bd5adcf2141a4c6c347e44af412c2f08 9546 admin required apt_3.0.4_amd64-buildd.buildinfo
 9ab4a999f5b44c0e100a28ed82c4fa3e 1453228 admin required apt_3.0.4_amd64.deb
 81965a85748671b97475b99a451d41af 135392 libdevel optional libapt-pkg-dev_3.0.4_amd64.deb
 c7a0afed979c0bbd5114849181aefcea 12753440 debug optional libapt-pkg7.0-dbgsym_3.0.4_amd64.deb
 a3e5129d1a771e97144e60830e74916c 1113872 libs optional libapt-pkg7.0_3.0.4_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE7cQ9mRD4+dWjjrb6PkCWRKsh20cFAmro0icACgkQPkCWRKsh
20cTHQ/+N9mP3tF6et3L4eqVv8Q1ST/iq7FtPPos5PxsC1/5L8H0qlJZ4elckI9b
caHokM/YA+1dZOyII9equnZZL5hICihIfyn/LErc11vrdYmrAFkZnav5LzgJUVMH
7kCCnuqCzqT60useG9kNf2hNqvkQTsACRjuecANp6WznYReMATxTxrxS0aKU8AZU
p+i6Sb+CyE+1uW4EOQv5NRUo7NIE1Uw6TN1G9DousHShdgtLuHrLQ8YXQnOUBSSa
n+uXt9hrdX4+AJQDkx5nnNLJJ8FmxXCF1qRxPpHzb6+KzFTrInpTvJ5Vhuft7yLz
eGLU1ENiW+KkqnzQ+2oqf9m1xjumRpvBTGhInWfIuDS405PACM3+x60drq2e5Dq+
PsJt7KUp142kdDq9TfI3qPhvn4ekC20UYM6Xo11HZymbFXQxElVS6HsxPaOt3aUp
bRx9T+8IP0y907XbIo7ib3Bz+nDoB+r2bILmT1IgCZH8x4h/8aJiXHgruNkRuC4/
wvhLyhAEjSjaEhjrr1zvnGDreHdeG+3t3YsutAtqRIhEOirsVtuTOLihaO6OKdjC
n4DHo7ejaPUjdFG2FohEnX5pGBsCuN/lMsZw9Jk4za4hShUcteftyzEKWYAe0Prs
j+drgGh0wibrtPRdG1Bw/mEKzFhmDiLW4p/NRF8UlFH99F/Dra8=
=Yn7G
-----END PGP SIGNATURE-----