-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 02 Nov 2026 14:41:34 +0100
Source: apt
Binary: apt apt-dbgsym apt-utils apt-utils-dbgsym libapt-pkg-dev libapt-pkg7.0 libapt-pkg7.0-dbgsym
Architecture: s390x
Version: 3.0.4
Distribution: trixie-security
Urgency: medium
Maintainer: s390x Build Daemon (ziehrer) <buildd_s390x-ziehrer@buildd.debian.org>
Changed-By: Julian Andres Klode <jak@debian.org>
Description:
 apt        - commandline package manager
 apt-utils  - package management related utility programs
 libapt-pkg-dev - development files for APT's libapt-pkg and libapt-inst
 libapt-pkg7.0 - package management runtime library
Closes: 1111554
Changes:
 apt (3.0.4) trixie-security; urgency=medium
 .
   * SECURITY UPDATE: Download verification bypass
     - methods/*.cc: Open target files exclusively
     - CVE-2026-109518
   * SECURITY UPDATE: Out-of-bounds accesses
     - deb: guard against unsigned underflow when trimming control newlines
     - gpgv: don't advance past the null terminator in PushEntryWithKeyID
     - debDebFileParser: reject .deb without a Version field
     - srvrec: reject res_query answers bigger than our buffer
     - tagfile: fix unbounded backward scan in Fill()'s trailing-newline check
     - solver: Ensure workLess is a strict weak ordering
   * Memory exhaustion during download
     - Move "Tried to start delayed item […], but failed" to debugging
      (Closes: #1111554)
   * Test suite reliability:
     - test: Limit valgrind to 1024 open files
     - .gitlab-ci.yml: Point at debian:trixie
Checksums-Sha1:
 f122cb7685c108dbcf406e4298703e9e39d1c1bb 8720512 apt-dbgsym_3.0.4_s390x.deb
 7043ae9b6dc83e2b0df261837407da1d545e6619 1706960 apt-utils-dbgsym_3.0.4_s390x.deb
 b04ac221b5b9c444352ba0a58917d1fd8d102aa5 324048 apt-utils_3.0.4_s390x.deb
 ac3bfde6b350c9c90eab3e5f37038ca73776718e 9408 apt_3.0.4_s390x-buildd.buildinfo
 30a362da74ee7e69bb36d7a4f71f340c6c86280e 1414712 apt_3.0.4_s390x.deb
 be1a2fa0b9f31777535d95fb0227bb6d10bb9d4e 135388 libapt-pkg-dev_3.0.4_s390x.deb
 4ea62816396978a14c2700b5aee95ede23a1ba75 12602228 libapt-pkg7.0-dbgsym_3.0.4_s390x.deb
 5a3f572aef4cd72c6e458b7ad6cd4905c160b22a 1067592 libapt-pkg7.0_3.0.4_s390x.deb
Checksums-Sha256:
 cc7fb64ad7b557b16099830bce837068751720e06e3a8b00dfe419afea998940 8720512 apt-dbgsym_3.0.4_s390x.deb
 001479c9f9f6a4241017934812d7881175143da0857715a6198e3a6476f5fdc8 1706960 apt-utils-dbgsym_3.0.4_s390x.deb
 2570ddf5bf810ced7dee97f8d7d016038febced0e5b253dcf011625ef45d4fb6 324048 apt-utils_3.0.4_s390x.deb
 5d5ccf58ea472335d5ded42004f3abe1d890eeba237c1e4c95333ac72327aad6 9408 apt_3.0.4_s390x-buildd.buildinfo
 07f74a20268a1430013090db7398c8a11a4e194c187f7e523f21aa011cf593db 1414712 apt_3.0.4_s390x.deb
 8ae4e90d358ef986c7973749dbef9d7ec0334883ed83934c3b62f3da9413a610 135388 libapt-pkg-dev_3.0.4_s390x.deb
 8d19cd961dcb3201d7e66cb107bdcfa94f7aced425d5c61785779f2c8485f14a 12602228 libapt-pkg7.0-dbgsym_3.0.4_s390x.deb
 d403c9d4b14d4d14c2908cbabe94ce0e2ae132a4499ed7b3ad5ab733d747b39a 1067592 libapt-pkg7.0_3.0.4_s390x.deb
Files:
 7753c336cbbf37d0418be377383ab85f 8720512 debug optional apt-dbgsym_3.0.4_s390x.deb
 f90c5723167d32933ea997241bc5215d 1706960 debug optional apt-utils-dbgsym_3.0.4_s390x.deb
 b15cd383e1c6e194cc72cbf4af38e547 324048 admin required apt-utils_3.0.4_s390x.deb
 1ec9f64cac07a022cc9d506ccafe1b9c 9408 admin required apt_3.0.4_s390x-buildd.buildinfo
 51fb428848d484c5512fb54241fb254f 1414712 admin required apt_3.0.4_s390x.deb
 dfac2fc332f8160f139c5a49d996262a 135388 libdevel optional libapt-pkg-dev_3.0.4_s390x.deb
 78afb098c7893db01c1349ec20387324 12602228 debug optional libapt-pkg7.0-dbgsym_3.0.4_s390x.deb
 96c1e4ff2c68abb21a281c3dc2b09547 1067592 libs optional libapt-pkg7.0_3.0.4_s390x.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEl0BM/nR+Oj597wRWMWUFebkHnoQFAmro0e0ACgkQMWUFebkH
noSLchAAnvgZKDULIVyQWl4TQibrIjqvJhFdPutv/cA6Pu5YPos3ePElVwZyNi3c
06ZNyE+jigPK2UXcaZyxhS+ausVc0K4qJqPjIkKTPfmHLNPltJVSh2UAmrzTQiq4
yd+9Ka6+LzKvOdbocUu94MCRUyN2yCCLk9ZFu4l/ezWNO38XaZoX+F/QndnGl/kP
WNiYuF30NKNza1NYmb5OkkEHKmY4zg9O3WTSlFj6U7nJPapnpktqbuopFMvv8DHK
nUSP9jUT4D73fDKKdJ5xtzbWD6goGd73Xwm+rTTSNfpTzPwCUmaBmiP46fl00zwS
7myKw0IRdQr0g8wtzgvZRuviBoqBd+uA3oOatY2Qpu5YXN8NVb6YK/CAyZifVQvl
rXnXAtq2c4D+Y3Z5qq5EwUN60nuqA7WXYYJoOacDzhmsqfijiatawn5paOU6ti8p
b4VjUIwH1Za/5NsmRgAM/1GX1Se7NVQJI+UWI9pCX45GkRZw8XAdob2v+LPamglP
12epAGJKGkSqY5sbGB3yyupLdORrNk0OEFVyk65KDbr16BCW6szOEs0+4+59xFn9
bqHZMkRF8oY8ATz2d8iaxTmbneJAgxqmm2txkPn2Xr1AXABld3BJPa0gyr4j66lO
OOpYUHba/FO7wOCHGDxUNhitYpx74nciwWVAqTlWUZFbdd9Q9UE=
=BmAS
-----END PGP SIGNATURE-----