-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 02 Nov 2026 14:41:34 +0100
Source: apt
Binary: apt-doc apt-transport-https libapt-pkg-doc
Architecture: all
Version: 3.0.4
Distribution: trixie-security
Urgency: medium
Maintainer: all Build Daemon (x86-grnet-02) <buildd_all-x86-grnet-02@buildd.debian.org>
Changed-By: Julian Andres Klode <jak@debian.org>
Description:
 apt-doc    - documentation for APT
 apt-transport-https - transitional package for https support
 libapt-pkg-doc - documentation for APT development
Closes: 1111554
Changes:
 apt (3.0.4) trixie-security; urgency=medium
 .
   * SECURITY UPDATE: Download verification bypass
     - methods/*.cc: Open target files exclusively
     - CVE-2026-109518
   * SECURITY UPDATE: Out-of-bounds accesses
     - deb: guard against unsigned underflow when trimming control newlines
     - gpgv: don't advance past the null terminator in PushEntryWithKeyID
     - debDebFileParser: reject .deb without a Version field
     - srvrec: reject res_query answers bigger than our buffer
     - tagfile: fix unbounded backward scan in Fill()'s trailing-newline check
     - solver: Ensure workLess is a strict weak ordering
   * Memory exhaustion during download
     - Move "Tried to start delayed item […], but failed" to debugging
      (Closes: #1111554)
   * Test suite reliability:
     - test: Limit valgrind to 1024 open files
     - .gitlab-ci.yml: Point at debian:trixie
Checksums-Sha1:
 04e4a01567a28d4b03d4e8ea283e8776b174bfa7 267520 apt-doc_3.0.4_all.deb
 0379f53dcc515f89640538549159009534149586 39048 apt-transport-https_3.0.4_all.deb
 5563a30feb8b044d377f1a9ace2a9c6993196843 10809 apt_3.0.4_all-buildd.buildinfo
 ffd907cf5565c733fed75c1b3d700fc2dcc6b893 1004828 libapt-pkg-doc_3.0.4_all.deb
Checksums-Sha256:
 f0c0629fd53f7ad068e7968b910043a259a62aa19223a4c8691be6a094b8f7e6 267520 apt-doc_3.0.4_all.deb
 1cb774b3dfdbe83626cf8e6a95fe785adbf14ce680a0c4c2f786577e63088978 39048 apt-transport-https_3.0.4_all.deb
 79214fb101d985f1a29f520b89442a685893343dc94326800ba1471dff766c32 10809 apt_3.0.4_all-buildd.buildinfo
 3f644a3ae36faa20cffecf6283129616071c0ab90c14e7402f27a9d40658f6c0 1004828 libapt-pkg-doc_3.0.4_all.deb
Files:
 bb1c4b3953c962bff2fa0d4df4e3cfc0 267520 doc optional apt-doc_3.0.4_all.deb
 a87ece59693dbb3889aedc2cbab9fac1 39048 oldlibs optional apt-transport-https_3.0.4_all.deb
 2ab93ce7da36e135bdf67de94b75af7c 10809 admin required apt_3.0.4_all-buildd.buildinfo
 886bdf504118952ad4e3110e8599a771 1004828 doc optional libapt-pkg-doc_3.0.4_all.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmro0eYACgkQmgPNRvTf
/zeXiA/9GVpl6pFabAqwwZ99VA/WNU9b/SJNuoob6INvpG/kczuEFptT5Kw1hJKD
CchIOLPYRMkO24MkbPlUapooWpdD+q1crvjnExybGwbzfPPPFRkpdaQhIjGR6I7r
50nGo8LkDx+AEnHC/U1gxqkkvA0cT95U8MdNizHMQDEPAQhUpjmXhwV8AZhPREAJ
z86jCGpwdQ7GaB9Fe0zn24/5VyZ0ydqHDonaRAFiBH383ltjTALR8uomBVQGa3Im
dV1Ery5ZBH5z4R4KKhD5wi7C0EvmwB8tmhnz9ieBeXthR6P/86wwgbC6cn/sfA8m
jLhdUbnQKKSm8qXOg6SBIlzNnIVCrPwlBNT34ooYECqXcOPswJy+SzWJP8Ut1HNj
ng1Rrd4a1fJMAQM8DjRk6DRdAE/rf44W10dYwJAPgbobddMyPMbv0YQGePfno9mW
zEQNeSSNuDx6v2mWXDN+4IBWTIZ7vVwkenuVlq0c37gOVBSHLKZFljDb6H+NJdiU
B/l/1Ex4H3xwSOhg0HE+PtbqRmvscKxOkbA4bQ1Z61UaN4FekJBflzXz0LgMBA7n
kp01kVWaor4TjpTN9uvdR4C+aMaIs2EZC3WxMU2or2tr0bo2/f260HPPyj6Q8scj
NCl5p+fr8WNAc2BRI9/IoVqeSpDs+CgIuBeTYwfj0lllQ7SGo2g=
=KDSo
-----END PGP SIGNATURE-----