-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 25 Oct 2026 19:12:11 +0100
Source: php-mongodb
Architecture: source
Version: 2.5.5-1
Distribution: unstable
Urgency: high
Maintainer: Debian PHP PECL Maintainers <team+php-pecl@tracker.debian.org>
Changed-By: Ondřej Surý <ondrej@debian.org>
Changes:
php-mongodb (2.5.5-1) unstable; urgency=high
.
* New upstream version 2.5.5
+ [CVE-2026-106432]: Bound-check string and binary lengths in BSON
encoder to prevent 32-bit narrowing
+ [CVE-2026-106436]: Encoder ignores libbson append return values,
aborting on oversized documents
+ [CVE-2026-112368]: Recursive bsonSerialize() output may segfault
Checksums-Sha1:
4bf0f5dfcae0c0314be7e9206eed3e0684f1f0a9 2374 php-mongodb_2.5.5-1.dsc
fb6d1445da9511ddce28e114cc2b745f9a071ef5 2277212 php-mongodb_2.5.5.orig.tar.gz
0b61d1b7e87a4ad85acb2fcc10884ce7b59c81ba 8192 php-mongodb_2.5.5-1.debian.tar.xz
5bdcc1288656743e8761611cd2d1fcd73f235fe3 7982 php-mongodb_2.5.5-1_amd64.buildinfo
Checksums-Sha256:
e1a6357e9cd231eab467babe62ea297194e7076c4d450daeb842760a83214ed8 2374 php-mongodb_2.5.5-1.dsc
0eaf84ff709f73183d80597f31ff02937f6aefde01eb895a0aa19334a290cec0 2277212 php-mongodb_2.5.5.orig.tar.gz
9bf2d0476aaaf0a5dfcf0d2eb89fb85baba48d2ac1c8b08af199a1a70128fccd 8192 php-mongodb_2.5.5-1.debian.tar.xz
12d507e03403daeb01729205650c3fd5f1a3ddb3d3b9920fa6c179fa3a84b10d 7982 php-mongodb_2.5.5-1_amd64.buildinfo
Files:
58d7e18a420c5597ba30a1e1e9cede8b 2374 php optional php-mongodb_2.5.5-1.dsc
7fd1c98fb542dd99806da858467ed001 2277212 php optional php-mongodb_2.5.5.orig.tar.gz
c96e1ec7d1f0a525689f4f94e65dbb95 8192 php optional php-mongodb_2.5.5-1.debian.tar.xz
dca67d12c3598a4e85cfeff9be383b14 7982 php optional php-mongodb_2.5.5-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEEw2Gx4wKVQ+vGJel9g3Kkd++uWcIFAmrhg9dfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEMz
NjFCMUUzMDI5NTQzRUJDNjI1RTk3RDgzNzJBNDc3RUZBRTU5QzIACgkQg3Kkd++u
WcJhrg//SUVmBH4BXtvoPK7Ss9gfr09A+eMLDdlaDyy+S0YbQIpjf6VGiWne9CSL
NBSEUgdON55OAHBfGWv/wYzFbwyewSPx+fel04tt3/0YwkHndMyGqzOs4bRZO1+G
UD5cs5n7YXVRskMvDrCnkK+1JYvjCUTzXWxRqYUQ7I9/Tb3gRThWAqc8iCJHgglW
yK9K1S4wC54YpK91kxUJOQtYQ4ih0J59VRP7ATPc898r/Z0B83HSHXkSKj3U45a7
/qyX20jV2TApj4KUemLw1sPUqawHhSNXDUdaq1vV843urbpaDmoaR8UelAKGUTuO
uWghhvnEuPoPO05s0AnH7uYdmB8sVTb/7/yh8xhidazKa4ly7guLm6E0/kmm8V+4
3m95kd5Pf77riiRKgdaBU6baONdQTgiOyfP/7RxZFWobUuSr7oqZxzL9L1owa3iA
Fye1icruhfixx/nhDkAVQRQnYEY0tEMa2CVTTOP//9jxxz0rDymcP2C+48FeZHVu
/0bECX1Ya3ijq+m4BLW/q0Oq6hY0WdMuaHuagFWP8CQY4aFATOTzeq7siSye/TP9
WnhGb+S3sjaLv75FnwZcQoFoR+rlYvHKmGLI/z5cS65PT5XQWift0OxM/t5hmOld
J50npe20Ro98J6aupBtbivhWyJVVNea63auNCl6da8GgtDImFwA=
=UNS1
-----END PGP SIGNATURE-----
