-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 03 Nov 2026 16:12:33 -0500
Source: mongo-c-driver
Binary: libbson-1.0-0t64 libbson-1.0-0t64-dbgsym libbson-dev libmongoc-1.0-0t64 libmongoc-1.0-0t64-dbgsym libmongoc-dev
Architecture: armel
Version: 1.30.4-1+deb13u5
Distribution: trixie
Urgency: medium
Maintainer: armel Build Daemon (arm-ubc-04) <buildd_arm64-arm-ubc-04@buildd.debian.org>
Changed-By: Roberto C. Sanchez <roberto@connexer.com>
Description:
 libbson-1.0-0t64 - Library to parse and generate BSON documents - runtime files
 libbson-dev - Library to parse and generate BSON documents - dev files
 libmongoc-1.0-0t64 - MongoDB C client library - runtime files
 libmongoc-dev - MongoDB C client library - dev files
Changes:
 mongo-c-driver (1.30.4-1+deb13u5) trixie; urgency=medium
 .
   * Fix CVE-2026-84965: heap write primitive via size round-up wrap during JSON
     parsing on 32-bit builds
   * Fix CVE-2026-84963: silent field truncation via unchecked int cast of huge
     JSON string values in JSON-to-BSON parser
   * Fix CVE-2026-84964: heap corruption via OCSP request double free from
     crafted multi-URL certificate in TLS client
   * Fix CVE-2026-84969: heap overflow via truncated base64 encoding of binary
     fields in length-limited JSON output
   * Fix CVE-2026-88035: heap buffer overflow via wrapped size check during SASL
     username canonicalization
   * Fix CVE-2026-88036: GridFS data disclosure and deletion via query-operator
     injection in file IDs
   * Fix CVE-2026-93394: SCRAM nonce validation bypass
   * Fix CVE-2026-96746: heap buffer overflow via mid-scan command list growth
     in client topology monitoring
   * Fix CVE-2026-106428: out-of-bounds read in SCRAM authentication response
     parsing
   * Fix CVE-2026-106431: one-byte heap buffer overflow in BSON bulk document
     writer
   * Fix CVE-2026-106438: silent Decimal128 value corruption via incorrect
     exactness check
   * Fix CVE-2026-106437: out-of-bounds read and write via undersized BSON
     buffer reservation
   * Fix CVE-2026-120955: application abort on malformed GridFS metadata
   * Fix CVE-2026-120678: leaks the decompressed reply buffer when an
     OP_COMPRESSED reply fails to parse (denial of service)
   * Fix CVE-2026-120684: GridFS gap lets a shared writer recover a protected
     client's password
   * Fix CDRIVER-6401: abort in cursor namespace parsing when no dot separator
     (required by CVE-2026-120956 fix)
   * Fix CVE-2026-120956: remote abort and memory disclosure from a malformed
     cursor.ns
   * Fix CDRIVER-6523: mandate raising writeConcernError (change SHOULD to MUST)
     + this fixes a potential loss of data by ensuring that a WCE reported by
       the server is propagated rather than discarded
Checksums-Sha1:
 b9e29c0143f207c75cb1bb1525727bafc033a6dc 300508 libbson-1.0-0t64-dbgsym_1.30.4-1+deb13u5_armel.deb
 cc4131a54faa5056089db73426d94372fc0780ce 81280 libbson-1.0-0t64_1.30.4-1+deb13u5_armel.deb
 14db8b083989f9b0b7b51f62632bacffc9e348c4 143420 libbson-dev_1.30.4-1+deb13u5_armel.deb
 7ae65934bb042faa84050f2a9d4992c1974cc33b 1601256 libmongoc-1.0-0t64-dbgsym_1.30.4-1+deb13u5_armel.deb
 a6c2fe31b44ae2cde16f262be0a58bfe0b9353b1 348512 libmongoc-1.0-0t64_1.30.4-1+deb13u5_armel.deb
 82842ddb7e155f4344d5bc97b9655af8c8d3be5a 442216 libmongoc-dev_1.30.4-1+deb13u5_armel.deb
 5607925781d3f66e5141a4463f10d5cef1a0ab8d 10379 mongo-c-driver_1.30.4-1+deb13u5_armel-buildd.buildinfo
Checksums-Sha256:
 4f4c4287d35740f489752b09b2b72b834b7592a79af5e095ebc5ceaf16229897 300508 libbson-1.0-0t64-dbgsym_1.30.4-1+deb13u5_armel.deb
 177d92ee824a6327c1a3ebadb1a7144ac8d8f4e5c877366bd1362f0c8d6afefd 81280 libbson-1.0-0t64_1.30.4-1+deb13u5_armel.deb
 b34f0931c3093b635064018765ae027368be2e48e5b7e52ed79435c0455c929a 143420 libbson-dev_1.30.4-1+deb13u5_armel.deb
 ea94021f1d1d33c824c235d32ddc6572fe133f1bb3a74657e829ddcb58a36213 1601256 libmongoc-1.0-0t64-dbgsym_1.30.4-1+deb13u5_armel.deb
 aa6694825ffcf2dd453ff564884282fce3bd87c448e6fc9a1db0549fa05b8bc2 348512 libmongoc-1.0-0t64_1.30.4-1+deb13u5_armel.deb
 d746b35654176637528db9bd3111af80a47e0d2bacf30e6dadbe9758274f457b 442216 libmongoc-dev_1.30.4-1+deb13u5_armel.deb
 0d06b5f76bcb771e219b5df924632ab26a4589cd1cf7c92cb64ab4f58182e466 10379 mongo-c-driver_1.30.4-1+deb13u5_armel-buildd.buildinfo
Files:
 1e8d4448f34555b29490e90ff43cdd47 300508 debug optional libbson-1.0-0t64-dbgsym_1.30.4-1+deb13u5_armel.deb
 6b5f1553dab5e862b27c07648c5ae7e7 81280 libs optional libbson-1.0-0t64_1.30.4-1+deb13u5_armel.deb
 6e039abca0dcff80c47b791d6dd40b28 143420 libdevel optional libbson-dev_1.30.4-1+deb13u5_armel.deb
 5dffeb890d46826d8000eee6007b74c0 1601256 debug optional libmongoc-1.0-0t64-dbgsym_1.30.4-1+deb13u5_armel.deb
 4e0a40f4926db7183a771832b32bc8be 348512 libs optional libmongoc-1.0-0t64_1.30.4-1+deb13u5_armel.deb
 dcf5059713c61f61d30c106b77c0e86e 442216 libdevel optional libmongoc-dev_1.30.4-1+deb13u5_armel.deb
 a0ca784dcf49f73e7040c8e0170b5314 10379 libs optional mongo-c-driver_1.30.4-1+deb13u5_armel-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEECx5fXZYVNP9tMtwlK1PZBedPspoFAmr46EYACgkQK1PZBedP
spo09A/+I6CxLLkRN5BaM6I0ItO2PTJjciJ2v6K/J/DmRISVC4qbRwae4dse0qJm
KCtKcrgkAlSGwjnipO41sW0cPDbBqWyB/YFaJ7KYKq76q9Uj0UMBfBReWOAmVnEF
jjVbhlMPQ5Hcl6PNGDV8AJ8jZPMKvXQpPdGPdoLJPpnkwOLlmZybB5KfIAAje59Q
KIXgesqvnDKKAUaivQC8ADRKVlMUDaCz1Qh5rxami6gYlPwyTaBXutoLX8XKW62t
qAX8ELmufBAdyFFvVZ7r0NF3ouGaCXI4UfpraTYVqP6JjPpGSbDKEISXBQPC+9KE
E8fpE9ZKnhzOK97ecRoPEVHHFfT3utCg7vHK0IF7FRmbVTj62YDxHvPdYC7XWiOA
EnFothOEnAADD7pPIT+VA9HmJ9y0viCxp+NXWsIHsFFwgqXzWm5KN9wMpIkLcjt1
rDjTQXhZOskpHO0jXRzFyAwSPluiQ8tyxLwkmZlNORecV0ik2iguaDFTgaEKAW33
OWwG9Wbz41UAhOAQ8rdJO8osHbs3ww11a/glNBYXUU4Bc9Z2D08QG4d2P+8JlIB7
COUNRzF5RZQ9eNUhLV1CvkHvWZN+VEg9vIjhSWOBDOqMVIAYmtyIFEDIcosxIN/9
gcDe0XmvJooSkhdaRcTHz6rLclCIC2dmnJMjAT6ORGvmbpLPVwg=
=Fh3A
-----END PGP SIGNATURE-----