-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 02 Nov 2026 14:41:34 +0100
Source: apt
Binary: apt apt-dbgsym apt-utils apt-utils-dbgsym libapt-pkg-dev libapt-pkg7.0 libapt-pkg7.0-dbgsym
Architecture: i386
Version: 3.0.4
Distribution: trixie-security
Urgency: medium
Maintainer: all / amd64 / i386 Build Daemon (x86-conova-02) <buildd_amd64-x86-conova-02@buildd.debian.org>
Changed-By: Julian Andres Klode <jak@debian.org>
Description:
 apt        - commandline package manager
 apt-utils  - package management related utility programs
 libapt-pkg-dev - development files for APT's libapt-pkg and libapt-inst
 libapt-pkg7.0 - package management runtime library
Closes: 1111554
Changes:
 apt (3.0.4) trixie-security; urgency=medium
 .
   * SECURITY UPDATE: Download verification bypass
     - methods/*.cc: Open target files exclusively
     - CVE-2026-109518
   * SECURITY UPDATE: Out-of-bounds accesses
     - deb: guard against unsigned underflow when trimming control newlines
     - gpgv: don't advance past the null terminator in PushEntryWithKeyID
     - debDebFileParser: reject .deb without a Version field
     - srvrec: reject res_query answers bigger than our buffer
     - tagfile: fix unbounded backward scan in Fill()'s trailing-newline check
     - solver: Ensure workLess is a strict weak ordering
   * Memory exhaustion during download
     - Move "Tried to start delayed item […], but failed" to debugging
      (Closes: #1111554)
   * Test suite reliability:
     - test: Limit valgrind to 1024 open files
     - .gitlab-ci.yml: Point at debian:trixie
Checksums-Sha1:
 28d98f23290a5a70fa5d2a3351c1ac23edbd630b 8639364 apt-dbgsym_3.0.4_i386.deb
 7b4e7ce22d71f90cfca98b14f41f383619f99cfd 1697112 apt-utils-dbgsym_3.0.4_i386.deb
 3d716d39e4574bace1a0dbd290d9eaa1826bed19 346552 apt-utils_3.0.4_i386.deb
 8464cbc763418306034bc981504ed473a8a1fe20 9432 apt_3.0.4_i386-buildd.buildinfo
 7823999b57d35befeb64098731a4deb2bce70dc8 1479176 apt_3.0.4_i386.deb
 7d0a36725d71b1d368d12f54ca6ff8343782bdcb 135388 libapt-pkg-dev_3.0.4_i386.deb
 2ea85f86f00f6a24fe7550704900b8180f7e27b6 12449524 libapt-pkg7.0-dbgsym_3.0.4_i386.deb
 295912efb04f6d900decc83eba8faa6768ea118a 1195556 libapt-pkg7.0_3.0.4_i386.deb
Checksums-Sha256:
 4dd10c2c1899b564d5b57319a381f6e2beb7440886d91a53568979ac59c58254 8639364 apt-dbgsym_3.0.4_i386.deb
 687716ee141a5a343f6c29a3d0a6b573b9d3c58394910d191a05c77e8c56210a 1697112 apt-utils-dbgsym_3.0.4_i386.deb
 5205a2f4ac32023238331c5c2607e2a9b9f19ac3afaa5e932aaea08f5bffdbd5 346552 apt-utils_3.0.4_i386.deb
 627a4d2e6056009b925dbd4e3be946e59d1bfb95d60809ec4f07c87ab6f46fde 9432 apt_3.0.4_i386-buildd.buildinfo
 f01eeb8e8e9b0eb6c8a40b733342cbeaadb17f71331806097c51a7bd4e3ca254 1479176 apt_3.0.4_i386.deb
 0acee3ec9a0730898b9cd200240f3f13f7698b826f7f88ec9813941013ccd110 135388 libapt-pkg-dev_3.0.4_i386.deb
 691d1ead42a9a20daa7cd64ff8d5d4aad7a8829466552f2e4e76872d6fce0d22 12449524 libapt-pkg7.0-dbgsym_3.0.4_i386.deb
 b5abb11df4acfe86ff14670b3193248ee38c3e8c57f68832a5c43b83d78542c2 1195556 libapt-pkg7.0_3.0.4_i386.deb
Files:
 4710002aac3084e97b42bd801eff6896 8639364 debug optional apt-dbgsym_3.0.4_i386.deb
 9a484a2847c801d27948f03b41e63d05 1697112 debug optional apt-utils-dbgsym_3.0.4_i386.deb
 bc3d149200a2bd94603e197de4c0c95f 346552 admin required apt-utils_3.0.4_i386.deb
 c909d963c1ba9c98682958b262ecc555 9432 admin required apt_3.0.4_i386-buildd.buildinfo
 2595b117f527697eb7fb073ae093df57 1479176 admin required apt_3.0.4_i386.deb
 2bbadbfe898922f0e4540fd4c88833aa 135388 libdevel optional libapt-pkg-dev_3.0.4_i386.deb
 c9fb5f031da15b2ba25cb9e920aee9c9 12449524 debug optional libapt-pkg7.0-dbgsym_3.0.4_i386.deb
 c84102f35a5a3447ba1e19654a3202cf 1195556 libs optional libapt-pkg7.0_3.0.4_i386.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE+i/sCsF3puL4e7qIGNGWmfrqILEFAmro0iMACgkQGNGWmfrq
ILF2IQ//bZtmEiASFd/DOSQgRHEZ+L0bBd7kyeobF3GocBJH6zOjpRCSrUjzq2QJ
8pwVd7LUVUTCWI0hPAkUypT8GDVs4N40053dzmgbTBjjPbeAlQFTz8FtZCSawozM
/QYFEDXjWoDzbfIcF4/gZcgplGmju3Wa7tCz56RI+0Ad1S29tog9m7zhmSrCO64l
z4tbzIOyK8Gi9ieS8x9XM5rQngI3+gRH8KaRhvS394Fp+7jJ00YW9GEURiuBsolh
ivjEdlSyrG8FKvBRytl/+ug+EWcHVtUZF0/dEeyYNLrfj6IfmJ9SHuF5SjBSIZpd
D9xrdlNUDGre12tp7xmhYJH4Ak1Y/bfBHeDcadE8oQoHtz2/xBuXRftR+A+eLTTu
iSG45eSrK4VhYp6P1MKAH/E7w6WfM/jzzWpEkhV9S0wO5G7L/wL55NYFeE2k0vpg
C8HBSFqb1qpR049PFcAoff7epJNGnNnN/77tLLvqQC5Ay5h7cvSE/yGyCkWwbVJz
BfMNggw7zCW6UbUJPY9VslRyIvR4HC8/IUctGTuG99Qzlr3Q1ArF+wpWyjeL6TdA
702TA/POOmdIHsm2s04kYuH4qM79gGgZ7Uchbh/jojLeLJr1DF1DJ+1hFdKQ+zjK
rLd68hrgAipkXHcaSFvAwIEhtMzISg6ocVG6Wt8MQNchBj0TsTQ=
=2j9C
-----END PGP SIGNATURE-----