-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 16 Aug 2026 18:48:26 +0200 Source: apr-util Architecture: source Version: 1.6.1-5+deb11u2 Distribution: bullseye-security Urgency: high Maintainer: Debian Apache Maintainers <debian-apache@lists.debian.org> Changed-By: Bastien Roucariès <rouca@debian.org> Closes: 1143837 Changes: apr-util (1.6.1-5+deb11u2) bullseye-security; urgency=high . * Team upload. (Closes: #1143837) * Fix CVE-2025-49506: Function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack. * Fix CVE-2026-32327: A stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function * Fix CVE-2026-34191: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. * Fix CVE-2026-34501: Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. * Fix CVE-2026-34502: Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client Checksums-Sha1: 82b6fdb628206f245d5495d9fd545af7698aa2f4 2536 apr-util_1.6.1-5+deb11u2.dsc 4cc73bc36ca697419f555476f2fc1c63df6069f4 428595 apr-util_1.6.1.orig.tar.bz2 8c2ad2bde9f45e1df0a5806c3d9ae1de09aaa860 350288 apr-util_1.6.1-5+deb11u2.debian.tar.xz 503cebd13b0fab37ebea9810d4623ce01dead209 5888 apr-util_1.6.1-5+deb11u2_source.buildinfo Checksums-Sha256: 9e0da3029f1fca236297ac93ce8e07a6522e121df69dbc5a12b3bd44a0ac0a27 2536 apr-util_1.6.1-5+deb11u2.dsc d3e12f7b6ad12687572a3a39475545a072608f4ba03a6ce8a3778f607dd0035b 428595 apr-util_1.6.1.orig.tar.bz2 28181ca096cd1759b5bb9f2cc10b4ad3e7c6f0d6d24cbde633d258a329e50215 350288 apr-util_1.6.1-5+deb11u2.debian.tar.xz ab7434398dad82b4710e24a7431f1b65208a8088b36240cd0b8d5efac2701a76 5888 apr-util_1.6.1-5+deb11u2_source.buildinfo Files: 126bf6b044d7e461f3aebb0fb1793ca9 2536 libs optional apr-util_1.6.1-5+deb11u2.dsc 8ff5dc36fa39a2a3db1df196d3ed6086 428595 libs optional apr-util_1.6.1.orig.tar.bz2 8c7e4d44d82396849b232841faa3d5df 350288 libs optional apr-util_1.6.1-5+deb11u2.debian.tar.xz 7b15905ee944d28c82dfa52804d262db 5888 libs optional apr-util_1.6.1-5+deb11u2_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmqB8BwACgkQADoaLapB CF/5Nw/+OBAPx1EgIpPd7YksDOAzh0kkMxlQ3SMaGbUWttDLJUIKAWg1sI6bQSF9 rl7eJ8LWGwB2+vwfSVKmHAaRK8SIm09YguC/n5b/og0G/8P6R9/UdPHyUFectzqt nlDmVcWoTSxS5Nd5PU6uRzJZarsxzWWgMAMvhi9BHg5Dt88NB0Rqeg5fWQrXYaOL vjNCKp41UmV0LXh+q0r89r1BXdK5H9wOevnNDq/J07dmwcEuekvoqX+8CkHpXc9T qyoPM5tEypLv6222Cgrv6HoTVZbG0CPBBbGeIKkCwjPostSgfT8n+gZpwfDu+2fX mpsvEaxmuIHP5v4QawQmjVB6+azobOoghPfUjq6E/Vk91Jmb99vh5lGYqZUeFvU5 DVE5S5tOUhvi2rDVoeFSxeBRIOtOZxbLCrR8228nln9sZKL7vVjxqTGs0tbwPg6P H5mIpCNgDArN3zE1fC82KJWLOTLa40Fzyepe9kb1TnorJX3xYCmLBZPdtV5fANxS AHDN759SaEe2YpdMiJB4nwspsw37uqtO3W8kYVM3eblsyP5TLgQ9NpM9HeH7mZex h+GqYhU4dsZe71vEvOUk00zbBwgm6t5dKcBdGMXh4polvZ94AbllPzYgWfvqZPk0 D07Xup66aaq0VDqXRzM5QDGQY5++Hsp+eBZGAq5WRFDofyCQmeE= =IdzB -----END PGP SIGNATURE-----
