-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 02 Nov 2026 14:41:34 +0100
Source: apt
Binary: apt apt-dbgsym apt-utils apt-utils-dbgsym libapt-pkg-dev libapt-pkg7.0 libapt-pkg7.0-dbgsym
Architecture: ppc64el
Version: 3.0.4
Distribution: trixie-security
Urgency: medium
Maintainer: ppc64el Build Daemon (ppc64el-osuosl-01) <buildd_ppc64el-ppc64el-osuosl-01@buildd.debian.org>
Changed-By: Julian Andres Klode <jak@debian.org>
Description:
 apt        - commandline package manager
 apt-utils  - package management related utility programs
 libapt-pkg-dev - development files for APT's libapt-pkg and libapt-inst
 libapt-pkg7.0 - package management runtime library
Closes: 1111554
Changes:
 apt (3.0.4) trixie-security; urgency=medium
 .
   * SECURITY UPDATE: Download verification bypass
     - methods/*.cc: Open target files exclusively
     - CVE-2026-109518
   * SECURITY UPDATE: Out-of-bounds accesses
     - deb: guard against unsigned underflow when trimming control newlines
     - gpgv: don't advance past the null terminator in PushEntryWithKeyID
     - debDebFileParser: reject .deb without a Version field
     - srvrec: reject res_query answers bigger than our buffer
     - tagfile: fix unbounded backward scan in Fill()'s trailing-newline check
     - solver: Ensure workLess is a strict weak ordering
   * Memory exhaustion during download
     - Move "Tried to start delayed item […], but failed" to debugging
      (Closes: #1111554)
   * Test suite reliability:
     - test: Limit valgrind to 1024 open files
     - .gitlab-ci.yml: Point at debian:trixie
Checksums-Sha1:
 827985e8d65a9fe94fa0c9f37588fedffe9eb2b6 8835684 apt-dbgsym_3.0.4_ppc64el.deb
 d2b19b451d18d4e57c8c5f86dc81473f5452ea13 1721312 apt-utils-dbgsym_3.0.4_ppc64el.deb
 c7926140219cfaf8a092f1f0892a0cc6e2e45513 332612 apt-utils_3.0.4_ppc64el.deb
 e419b87b2762de7ade973fde581558b93a1aa743 9575 apt_3.0.4_ppc64el-buildd.buildinfo
 5dc40efa33ce37df6830c4ad51e56e3a6fddd1c5 1427012 apt_3.0.4_ppc64el.deb
 65cb7b8ab88857ba45fe379feefeb64ecb4578e7 135404 libapt-pkg-dev_3.0.4_ppc64el.deb
 d53dca08766ebecee191f3b014f58e97af7442a4 12566044 libapt-pkg7.0-dbgsym_3.0.4_ppc64el.deb
 2f88b8f5d8a7035f33533581fb1d1c48a6e71c74 1083996 libapt-pkg7.0_3.0.4_ppc64el.deb
Checksums-Sha256:
 417c5041f3dd623d5fe96f8e0c4ff2e5a7af68d9341a215b5ea8af9bebe76305 8835684 apt-dbgsym_3.0.4_ppc64el.deb
 568d9ab2205f7ee0ff499175452a0e171d858d7b4dd8e2a7d7667f8d629cf041 1721312 apt-utils-dbgsym_3.0.4_ppc64el.deb
 2fe9bf9030fe8a9721cba707b73b92cc29432c8351aad4da08d576733b9bad6f 332612 apt-utils_3.0.4_ppc64el.deb
 9aefec6f73d76c6faeb2f05bde41b657de6d11099c5ac6c68fe6437e28c472a1 9575 apt_3.0.4_ppc64el-buildd.buildinfo
 c3874d5aaa09faf2916e0c53770afdbbf0c7aaecdb9d310458a023c4c3b22f9a 1427012 apt_3.0.4_ppc64el.deb
 aaf94b2851bc02fce9a8876a1c57829fea4e5d666e2f1788b8ccd3813fc02766 135404 libapt-pkg-dev_3.0.4_ppc64el.deb
 b9a4f74eca4f5dd5d67b0193c23b0c8bc4af03c6681924551e85abb64e75f0d7 12566044 libapt-pkg7.0-dbgsym_3.0.4_ppc64el.deb
 7ac2847b318f64804dd33e1e57cd7809e40b045a26da5229119c82e080c82039 1083996 libapt-pkg7.0_3.0.4_ppc64el.deb
Files:
 42ffbff9ab4b0a8bb5a28eb835441b6f 8835684 debug optional apt-dbgsym_3.0.4_ppc64el.deb
 1a1e03041a08d1ca9460dceb91c17352 1721312 debug optional apt-utils-dbgsym_3.0.4_ppc64el.deb
 f7a7147abfd65fd1ec9e73bc99158c3d 332612 admin required apt-utils_3.0.4_ppc64el.deb
 d382d1a37b8617c70d35129389526db3 9575 admin required apt_3.0.4_ppc64el-buildd.buildinfo
 d6ff1ff85580419f1e1b4edf4c9b9948 1427012 admin required apt_3.0.4_ppc64el.deb
 9e8fed70262d56093473c388192cbe39 135404 libdevel optional libapt-pkg-dev_3.0.4_ppc64el.deb
 cc879e66d49a01ce1d0d9234a296f25b 12566044 debug optional libapt-pkg7.0-dbgsym_3.0.4_ppc64el.deb
 4a3b7f677f26fbfc9a37a2947c6302c5 1083996 libs optional libapt-pkg7.0_3.0.4_ppc64el.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEETLpi2USYGUNSlYhoNINNphgym2QFAmro0gEACgkQNINNphgy
m2SMdw/+KETfR+WGGYIinjqyQgEv42Si71SJLuinASl9ESI9sRU5munoI7AcL8KF
aKIbag/kEqhx2WiBN8MzeUqmTUiqOvqK2YsdZeiHJA8xdW8iZzLrGasZBm2pNDZv
i2Vju6MallPieU2elilthJdtrxDGFSWP9Zod2fLbbzWnkF6K5BBEw9c/lf9ooIKV
oBYsQpnhpZkjvE6iXMUWy4uKKtHB6ECmJ9QNSqH3SKM5sG2sBXotkMx8g7B3Mgfe
KUHfOcXbincX7txfWt/RsYi06NF8Cjy714rnwbOj2UnMeeyExB0uqAmeZay0c21X
RqWkFtHmjc/sZHFU2rKYeJCHjiUDxbTugio9hreRfPYOQLIhcj8u2iYJE758ssZi
45z21YSWFDYR+uBGU3tyP5zx7YicTjVmsjNy8tSeOk9Q1/TPim+qDTDHpdJucsLM
bTHk5OHvu2Hbq0osOAVDSFvcVualFqe2CUWzU3BLDNTcNLVLPuBNGYd3a3HmM8Ym
4axPmpHMMolOuW3pBndhucwrMW7EKKBUCZ7Ig3WCM65U1Y0akdT+m31227xYSLV4
Jnm6pGehu8R4mx1djCqKAD3RPaV7a3OZCTamUeNfMrscykAYk1528p7cf/2430wO
eHwO/fMtzkzt6yDwtq9iiCPmjf9v2WRBEpzN6HqNCBJIEnKuAGo=
=D4y3
-----END PGP SIGNATURE-----