-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 02 Nov 2026 14:41:34 +0100
Source: apt
Binary: apt apt-dbgsym apt-utils apt-utils-dbgsym libapt-pkg-dev libapt-pkg7.0 libapt-pkg7.0-dbgsym
Architecture: arm64
Version: 3.0.4
Distribution: trixie-security
Urgency: medium
Maintainer: arm64 Build Daemon (arm-ubc-05) <buildd_arm64-arm-ubc-05@buildd.debian.org>
Changed-By: Julian Andres Klode <jak@debian.org>
Description:
 apt        - commandline package manager
 apt-utils  - package management related utility programs
 libapt-pkg-dev - development files for APT's libapt-pkg and libapt-inst
 libapt-pkg7.0 - package management runtime library
Closes: 1111554
Changes:
 apt (3.0.4) trixie-security; urgency=medium
 .
   * SECURITY UPDATE: Download verification bypass
     - methods/*.cc: Open target files exclusively
     - CVE-2026-109518
   * SECURITY UPDATE: Out-of-bounds accesses
     - deb: guard against unsigned underflow when trimming control newlines
     - gpgv: don't advance past the null terminator in PushEntryWithKeyID
     - debDebFileParser: reject .deb without a Version field
     - srvrec: reject res_query answers bigger than our buffer
     - tagfile: fix unbounded backward scan in Fill()'s trailing-newline check
     - solver: Ensure workLess is a strict weak ordering
   * Memory exhaustion during download
     - Move "Tried to start delayed item […], but failed" to debugging
      (Closes: #1111554)
   * Test suite reliability:
     - test: Limit valgrind to 1024 open files
     - .gitlab-ci.yml: Point at debian:trixie
Checksums-Sha1:
 551b01a09ade693537c1e60580bfdba8a7bb9c0c 8740844 apt-dbgsym_3.0.4_arm64.deb
 2e651139c05f97b30fc82bcdb056e4f71059b484 1701344 apt-utils-dbgsym_3.0.4_arm64.deb
 cb398ccd2782852d0040e6835e2417dc238402c6 315768 apt-utils_3.0.4_arm64.deb
 bebd457713d75c593d3e5363d1aae5726c6631cd 9530 apt_3.0.4_arm64-buildd.buildinfo
 3ba5df771d2e9c8460fe68d5a13cc50f54072b7b 1362704 apt_3.0.4_arm64.deb
 31699f15e92c7ce5c6859dbf0c53e67fcf39d4a1 135392 libapt-pkg-dev_3.0.4_arm64.deb
 239ee4998daa940d804bb47016da71ee299d9042 12304616 libapt-pkg7.0-dbgsym_3.0.4_arm64.deb
 21bc3050a03f22b368cb3a7583fdc7aa15eec762 978204 libapt-pkg7.0_3.0.4_arm64.deb
Checksums-Sha256:
 0d08c598cfe42a367ed7d2bc6a305e6da36ded823e383ae1b1aa663ed5c431af 8740844 apt-dbgsym_3.0.4_arm64.deb
 ca52d1b1dd70899dfda12c75616172a066c730f908af61ead7d2a23499b28df7 1701344 apt-utils-dbgsym_3.0.4_arm64.deb
 d01a163e6c25cd74edeb64ab94301aa8ec6b7f4683683a4c86bd840896bc651f 315768 apt-utils_3.0.4_arm64.deb
 ebbb8dd3693589dbf49fb829cd4ce46b11dd2c4c8363bfd573792e4dfb19863d 9530 apt_3.0.4_arm64-buildd.buildinfo
 9a3ee57117d1d8e086e2d8917cd3e85e8f76da25dd18a898085759668dc5c71f 1362704 apt_3.0.4_arm64.deb
 c85cdffb00931e056114fd1c22dbab812e64c8f8e3e0b28b0dc464fcaeeb6f51 135392 libapt-pkg-dev_3.0.4_arm64.deb
 69ab289fe044d058970051240f4e1ee8a9bde79b52cf42730fc827b3c7081b3b 12304616 libapt-pkg7.0-dbgsym_3.0.4_arm64.deb
 39e4d074bc4f2081666a3625561a430fedb0c85b1a6a657c02760383232304bd 978204 libapt-pkg7.0_3.0.4_arm64.deb
Files:
 d2a0ca6016b8fcbcc1f8cd3ca99ed5c3 8740844 debug optional apt-dbgsym_3.0.4_arm64.deb
 1d06409be077aab475c86c82fe8d59b2 1701344 debug optional apt-utils-dbgsym_3.0.4_arm64.deb
 809f51d931bcfa8cdb5c905d1f1542a1 315768 admin required apt-utils_3.0.4_arm64.deb
 7b3890ea3658501871987e77883dbd96 9530 admin required apt_3.0.4_arm64-buildd.buildinfo
 2dabe1bdf4e26372c10e470467b67806 1362704 admin required apt_3.0.4_arm64.deb
 7fa6254d3f5f424711e74de424843c15 135392 libdevel optional libapt-pkg-dev_3.0.4_arm64.deb
 0f73e599625c8e267b4ec566c646d5a2 12304616 debug optional libapt-pkg7.0-dbgsym_3.0.4_arm64.deb
 83ab1806c1e3ebb33591ff76be6d7a7e 978204 libs optional libapt-pkg7.0_3.0.4_arm64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE7rv+l3KtZdQea77lnwznazfjXToFAmro0fgACgkQnwznazfj
XTpYGA//R4+1l2zmyBeuLaZTnby+JH3LOzQQRQgd75NrI6GxY6STq3x5N9OTzoXr
BXhoHCrdJbgJx2Hy/al0dRrv+ShGiiJuTQdkCj9ZP2vn9+nmSX6nS+t22nIcGV0F
oS9Ih40MwSB5v2EAEEilW+OgVl67R54EKoej/dhMRza4qVzF+AepWC0dZPAuLwkn
8+78MHTPIUyWvpAfOZvW4/894mRshliULFZ5Z4xgOdIN54maLxmf/JA2jXei3wkv
Re48ZxN1FIaZnIiF1Gv/82Lu6kN6t72nroWRS6WCQzkZ2mJCH9DaPclysyTzES5/
5urD6enqxWmwJaQI6gZqOZKBxqm7kR3nUG38kn/Uy/tGVtAp9qIa76QCcGTs7KuJ
3bHPeejqh2uDtoHCfyEHE2heGMqjqcBSjEg/0M2Lj+E25BlZrwoikY8N813MlZAP
gbtxNxHzFf8+qUoH1qc9dDgCsxVS6egk1J1Y/8x1Z5twyJRs0SOg69eX1IK3pbhW
LzLR9YSO3W6oI2+IJfjfKQXnkl8FX52/vbZdLsQGKKDoeS26fcveFL1uZOW3Us/Z
X0RvIO3b0MPcVl1VSec0IsY/w1bgoI9aNk60PnMo3xWLG2c3cVQ7f6Ghb2tK9ESn
P2gVBnFcn5WMywwCmEcKK8p6rkrABsSlB8ComQ9KdeP4Kf1Eqxs=
=3r43
-----END PGP SIGNATURE-----