-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 02 Nov 2026 13:55:59 +0100 Source: apt Architecture: source Version: 2.6.2 Distribution: bookworm-security Urgency: medium Maintainer: APT Development Team <deity@lists.debian.org> Changed-By: Julian Andres Klode <jak@debian.org> Closes: 1111554 Changes: apt (2.6.2) bookworm-security; urgency=medium . * SECURITY UPDATE: Download verification bypass - methods/*.cc: Open target files exclusively - CVE-2026-109518 * SECURITY UPDATE: Out-of-bounds accesses - deb: guard against unsigned underflow when trimming control newlines - gpgv: don't advance past the null terminator in PushEntryWithKeyID - debDebFileParser: reject .deb without a Version field - srvrec: reject res_query answers bigger than our buffer - tagfile: fix unbounded backward scan in Fill()'s trailing-newline check * Memory exhaustion during download - Move "Tried to start delayed item […], but failed" to debugging (Closes: #1111554) * Test suite reliability: - test: Limit valgrind to 1024 open files Checksums-Sha1: 96b089aa0ac84c2339293d766f8b918efb8f4747 2933 apt_2.6.2.dsc c4dece42dfb495eadcff757517c2367f33cbc362 2329740 apt_2.6.2.tar.xz b439ec84e8d39ae7804004b2656274131b76f71c 8207 apt_2.6.2_source.buildinfo Checksums-Sha256: 63490cc85118a0eb7a3109696311920ffa70f3f9ad718bcaf126445496049c74 2933 apt_2.6.2.dsc 12c38c9b2b8159bc1780eb17acff0adf6d6b2dff3d560f557b9ad9f60b3cc63f 2329740 apt_2.6.2.tar.xz f47da3ee75ad7c226ed84ee3f37073c17ce93d36d68b4f8188ff37ce1d2e39a9 8207 apt_2.6.2_source.buildinfo Files: 3e6e68019060afe4dcf2b5a5ba07487f 2933 admin important apt_2.6.2.dsc a6b480e6e505900b6ac7c51bbc7f7366 2329740 admin important apt_2.6.2.tar.xz d4a23223ef9818ad329587869bd7019c 8207 admin important apt_2.6.2_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJDBAEBCgAtFiEET7WIqEwt3nmnTHeHb6RY3R2wP3EFAmrozmYPHGpha0BkZWJp YW4ub3JnAAoJEG+kWN0dsD9xNOUP/jO5zEp55LafLdedzQuVWn4b2TdeYTH+gTtS bkqPg0zj/GbtAMYBtk3gPrHZLtiiSZO0XzIqyJxVMbFiMK1rLIo8PbI2DkH41XsM oiBuR3+HuDUPYQJamEr+6yGCEtq0+ZXWLzJPOMToP7UEljFUut67JQm8MEns+DUw un+QrjPl4Az8Bc3zERa9+AqQVnxoJyHxVftJ0cp4Hl/MMZOzt4kkzoPLuaBkG/7y 7jHsTwS5ucPuFu4XpzbcQSpZKvSaALO8Hm33jSr7hkUZvX+PyuqO6vmOCMNbm+Lc YkFqNoN7zDJ1Hq8FGNcPAoN+CiE9WxrVnKgVBggsloC7rRDluGAdv8sxCXi/2RhW rNr+Haww4yVuCym4Fk4TuiCxcScD/tzPXtJEviY3OetntHl/K33IyVyVGtdBaRTs T/6Y5bsp6o1xnTC3kR5ESxBB9ZGEoBfgrbG76lzYwbxVfdA2OErsiHyiMZ5TIPhW zpE1MbeTK4dJy5uyJaiuQe8uCy2b5ToKspRRVvNdLi6Jo2wEnoqNwNF5IfnOFB5w EK+erqMYkhaxVy/BGtfhZNyRZWzuKmcdezYdABHZmkwTIqMx22Oy4Q/0A2EZPKqZ cja8AJ/W1Hpx9z4hNA8rb4u/b8PEFlIHAysNLRR8OEmsxAB/cK8X825qMAX19Vu2 f2SEpM1F =qGCI -----END PGP SIGNATURE-----
