-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 02 Nov 2026 14:41:34 +0100
Source: apt
Binary: apt apt-dbgsym apt-utils apt-utils-dbgsym libapt-pkg-dev libapt-pkg7.0 libapt-pkg7.0-dbgsym
Architecture: armhf
Version: 3.0.4
Distribution: trixie-security
Urgency: medium
Maintainer: armhf Build Daemon (arm-ubc-06) <buildd_arm64-arm-ubc-06@buildd.debian.org>
Changed-By: Julian Andres Klode <jak@debian.org>
Description:
 apt        - commandline package manager
 apt-utils  - package management related utility programs
 libapt-pkg-dev - development files for APT's libapt-pkg and libapt-inst
 libapt-pkg7.0 - package management runtime library
Closes: 1111554
Changes:
 apt (3.0.4) trixie-security; urgency=medium
 .
   * SECURITY UPDATE: Download verification bypass
     - methods/*.cc: Open target files exclusively
     - CVE-2026-109518
   * SECURITY UPDATE: Out-of-bounds accesses
     - deb: guard against unsigned underflow when trimming control newlines
     - gpgv: don't advance past the null terminator in PushEntryWithKeyID
     - debDebFileParser: reject .deb without a Version field
     - srvrec: reject res_query answers bigger than our buffer
     - tagfile: fix unbounded backward scan in Fill()'s trailing-newline check
     - solver: Ensure workLess is a strict weak ordering
   * Memory exhaustion during download
     - Move "Tried to start delayed item […], but failed" to debugging
      (Closes: #1111554)
   * Test suite reliability:
     - test: Limit valgrind to 1024 open files
     - .gitlab-ci.yml: Point at debian:trixie
Checksums-Sha1:
 9c9d82b06781b344f6b6f1d5b1861af681f51191 8555528 apt-dbgsym_3.0.4_armhf.deb
 b31ac26fd0e53c5dedd59f7c55f0e622e87f0b77 1696112 apt-utils-dbgsym_3.0.4_armhf.deb
 3de594659d9009d07b489fae86e12a7b6d625599 311128 apt-utils_3.0.4_armhf.deb
 266b1ee123dd2565204d9e3ec34a818200950206 9409 apt_3.0.4_armhf-buildd.buildinfo
 c078bb268dbff8081a07ba0076fa30d171fc1100 1363268 apt_3.0.4_armhf.deb
 37ff5e4465b1007eb4234b385c87215c80374404 135392 libapt-pkg-dev_3.0.4_armhf.deb
 6a8aad65f159d8b32a2e8c75f04361687b66137c 12305444 libapt-pkg7.0-dbgsym_3.0.4_armhf.deb
 88c56eae192152e0b9df4c7915f30802bd31ce41 974004 libapt-pkg7.0_3.0.4_armhf.deb
Checksums-Sha256:
 9367271885a4fceb1aa049fe9977d6ee2fa197772072d1323b55856c7c512db0 8555528 apt-dbgsym_3.0.4_armhf.deb
 da8d59eff37f401a2ae2adb67987b435606c11be70607a33411e19be659687cd 1696112 apt-utils-dbgsym_3.0.4_armhf.deb
 f589d7884fda42e4c3af904f70e9f454d45b7c7e25e0ba961769bcad5e5e8103 311128 apt-utils_3.0.4_armhf.deb
 0b566cf3c735b8929d2df2a45eb473fea6951c34db72c030d203ecdd35a1b2f4 9409 apt_3.0.4_armhf-buildd.buildinfo
 a8ecc15e2e95d612ac0faa65b26ca00152e5dfd13dc4337618ee933dd4b82e62 1363268 apt_3.0.4_armhf.deb
 b2c426f351b6d306c285080eb5c5ef693898313e1a96c34c7ed3a28f11f4378b 135392 libapt-pkg-dev_3.0.4_armhf.deb
 810d786d3492f2d6966fa65d713ab6441cfd952214378a49440708754dfd1f58 12305444 libapt-pkg7.0-dbgsym_3.0.4_armhf.deb
 bd9179b3b0de7f7a6b40b1c5f8825081715b242b428f026b51fd0d2176f5747e 974004 libapt-pkg7.0_3.0.4_armhf.deb
Files:
 910d218cb15eb62f1119041a33410d24 8555528 debug optional apt-dbgsym_3.0.4_armhf.deb
 3587bf5af2d588f856a8d179e9ee817d 1696112 debug optional apt-utils-dbgsym_3.0.4_armhf.deb
 86d1b8f3732a459a59ac2b995824ff60 311128 admin required apt-utils_3.0.4_armhf.deb
 3bce4de130dbaff505d417c52623c888 9409 admin required apt_3.0.4_armhf-buildd.buildinfo
 da38c4eb37698c181dbf31583f523d5e 1363268 admin required apt_3.0.4_armhf.deb
 affc1bc8cd0e521dfa39b03307219ca4 135392 libdevel optional libapt-pkg-dev_3.0.4_armhf.deb
 a11598cd8aeb221fe13fc373caa37a9b 12305444 debug optional libapt-pkg7.0-dbgsym_3.0.4_armhf.deb
 1e1e70bcdc0fb9376cac05e9ffc489d3 974004 libs optional libapt-pkg7.0_3.0.4_armhf.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEBOUsBrtd5lcy6oRfutMAkCxKbL0FAmro0fUACgkQutMAkCxK
bL1exQ/9EbUATjlTWcnAUYNrZ2QfrNntm6iNNVVCSlwpgyg4XRu6bmt2VEcDCslG
b4CT+8Eu736IUJQvaCi7nNOg/360efCHdvUNppxcR6uzZ4FYGI/L8zM/wJQIYRkf
uKt3eqEP0zZran3392HI+vWfHUcKXKJJkVAAPW+AhdwfPrP3qXqV+M1b7TpezvfI
VaoqF1dq0pSBG63o63G90n5BAidxNAlQv34pe4FvQVeOTo458JPQuMoT6LZQJipX
y2eXIv90wGx9Oif9GHqbnsubuez5rIcrxcNpcIqINYCTuzzB0Y9KYMVxtTzNSHia
Y+3vN5zhq6NJKWbBHTr24go141Slw3lHlonZW/QC4X0AXxniQbVyBlZr/d6ECU3m
/11XuAAQ22l6GMMwFLVMlZvBw2UaAthEBzC2ZNHNOF7GR6HQsJa9e3WXytHba2KT
Q87w26OTWM32mftKzBZVQ49DZ3H1wWyU9+0WB0U92+P1Jszcg4r1ANiaAMibISjA
gAdBU3iHUMVr7UjTanULCs0wddfT9rn5lCyuBs2lbqAehLJlgEit7Hk67+7vnbF9
3Xo1pvawE+LiY4ZTqjNzZMCIUZjMBWeFkaHu//Wk6YkUKsu8psUEGrRDBVhGPWws
y8CACyvCJV+N/0+sETli4UQZDp9YwD7L45Yc9cxw8Se+LbjkqCk=
=RRPM
-----END PGP SIGNATURE-----