-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 02 Nov 2026 14:41:34 +0100 Source: apt Architecture: source Version: 3.0.4 Distribution: trixie-security Urgency: medium Maintainer: APT Development Team <deity@lists.debian.org> Changed-By: Julian Andres Klode <jak@debian.org> Closes: 1111554 Changes: apt (3.0.4) trixie-security; urgency=medium . * SECURITY UPDATE: Download verification bypass - methods/*.cc: Open target files exclusively - CVE-2026-109518 * SECURITY UPDATE: Out-of-bounds accesses - deb: guard against unsigned underflow when trimming control newlines - gpgv: don't advance past the null terminator in PushEntryWithKeyID - debDebFileParser: reject .deb without a Version field - srvrec: reject res_query answers bigger than our buffer - tagfile: fix unbounded backward scan in Fill()'s trailing-newline check - solver: Ensure workLess is a strict weak ordering * Memory exhaustion during download - Move "Tried to start delayed item […], but failed" to debugging (Closes: #1111554) * Test suite reliability: - test: Limit valgrind to 1024 open files - .gitlab-ci.yml: Point at debian:trixie Checksums-Sha1: 10cfc55acc4632dce0336edd1a40ad51b46ea50a 3091 apt_3.0.4.dsc b1e9d1bda2a44fef4ea8db7e78c7b89765905631 2423460 apt_3.0.4.tar.xz 881db983a5d9c53d15afd649a70b8de384479e19 7873 apt_3.0.4_source.buildinfo Checksums-Sha256: efc029dbfb0e264dfb38a8bf34398a8d3709cd35a463c270153b59e2e4ffb404 3091 apt_3.0.4.dsc e853aec49afbe520ebcd4dbcbc98e1c55262c6bf1c119cf43e6aec69752443c6 2423460 apt_3.0.4.tar.xz 260c4a6fb72ffb9e1feb48cf7981ad889c6e8211d0700927220fa0d7a1e490e3 7873 apt_3.0.4_source.buildinfo Files: 98fbdd8fdb5c59caed79448f0ecb0a0f 3091 admin required apt_3.0.4.dsc 6c165ba5bc1250044c9b1491d87f8006 2423460 admin required apt_3.0.4.tar.xz da9a63e9d19228171f5a4594bcae1aaa 7873 admin required apt_3.0.4_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJDBAEBCgAtFiEET7WIqEwt3nmnTHeHb6RY3R2wP3EFAmroy/sPHGpha0BkZWJp YW4ub3JnAAoJEG+kWN0dsD9x9CIP/jdvJAkN/Mam9OVo3Bo7pBgF0N7OW08rch+F r3ASzpWsbnnCYPUuSv1YYrl8YtZNThCi9HaAN1Ttykgjcgf0yku/QUPCXuoi4pot XFPXURXjb2urd3iwNn51nPBKyI/WOvbl8ahbrGoOhqpLzbgx5kCzcYkqh8afA5sS FJ2J4//BLNEkQNCUPA2lvqEKW850PffXw8ceX/ZpllRzeBUA1rzxXHI8Ol1n0Tqm binj/XusKXTKmIqrXZTmyzy4XnE7fzdq8dlEHl9P7caRHgDPTmYbNXT4u1e+afGW iM6HONv8Yag/RSKelz375qIABnlWDqMmCAYNaaIgrXoni27z4hHFL8XBrolWqQKk 2kAFpTMWbA822OuYh9A6qxkxsdPLSYeMYVGaNt9Y3c4Rgp9kc4uN6AZPC+w3qoVM QVMqlWvjxcWZU3+BYF6n0wbrVPFDpXVwYg/jqw5iV0SXjuevaF4YPk6dw5WBkPOT d5jUJHCm5OgfpBUhKRq1pBiGmpnKfokmlL8/e3iKweLWFf5FXA4p1C6bOmyzKmjQ Qk97rnj1v6MARsR8246bibdNvmcrLLpsivtI4GjNr1kidrWMXJ0wan3DzkUvtawF /f+1GF6+QMeFnH03ieziTJYyahN2yoYrrPhEUiv8ZoQ+4jd04w5hHAielvz2eW/d CqV1xbfn =nY77 -----END PGP SIGNATURE-----
