Package "libapt-pkg-dev"

apt (2.4.15ubuntu0.1) jammy-security; urgency=medium

  * SECURITY UPDATE: Download verification bypass
    - methods/*.cc: Open target files exclusively
    - CVE-2026-109518
  * SECURITY UPDATE: Out-of-bounds accesses
    - deb: guard against unsigned underflow when trimming control newlines
    - gpgv: don't advance past the null terminator in PushEntryWithKeyID
    - debDebFileParser: reject .deb without a Version field
    - srvrec: reject res_query answers bigger than our buffer
    - tagfile: fix unbounded backward scan in Fill()'s trailing-newline check
  * Test suite reliability:
    - test: Limit valgrind to 1024 open files

 -- Julian Andres Klode Mon, 02 Nov 2026 13:56:44 +0100

  apt (2.4.14) jammy; urgency=medium

  * Fix buffer overflow, stack overflow, exponential complexity in
    apt-ftparchive Contents generation (LP: #2083697)
    - ftparchive: Mystrdup: Add safety check and bump buffer size
    - ftparchive: contents: Avoid exponential complexity and overflows
    - test framework: Improve valgrind support
    - test: Check that apt-ftparchive handles deep paths
    - increase valgrind cleanliness to make the tests pass
      - pkgcachegen: Use placement new to construct header
      - Workaround valgrind "invalid read" in ExtractTar::Go by moving large
        buffer from stack to heap. The large buffer triggered some bugs in
        valgrind stack clash protection handling.

 -- Julian Andres Klode <email address hidden> Tue, 22 Oct 2024 15:09:58 +0200

  apt (2.4.13) jammy; urgency=medium

  * Fix keeping back removals of obsolete packages (LP: #2078720)
  * Return an error if ResolveByKeep() is unsuccessful (LP: #2078720)

 -- Julian Andres Klode <email address hidden> Thu, 05 Sep 2024 16:43:03 +0200

  apt (2.4.12) jammy; urgency=medium

  * Restore ?garbage by calling MarkAndSweep before parsing (LP: #1995790)
  * For phasing, check if current version is a security update, not just previous ones
    (LP: #2051181)

 -- Julian Andres Klode <email address hidden> Tue, 13 Feb 2024 16:39:04 +0100

  apt (2.4.11) jammy; urgency=medium

  * Backport archive snapshot integration as of 2.7.3 (LP: #2038453)

 -- Julian Andres Klode <email address hidden> Fri, 06 Oct 2023 10:53:53 +0200