-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 03 Nov 2026 16:12:33 -0500
Source: mongo-c-driver
Binary: libbson-1.0-0t64 libbson-1.0-0t64-dbgsym libbson-dev libmongoc-1.0-0t64 libmongoc-1.0-0t64-dbgsym libmongoc-dev
Architecture: armhf
Version: 1.30.4-1+deb13u5
Distribution: trixie
Urgency: medium
Maintainer: armhf Build Daemon (arm-conova-03) <buildd_arm64-arm-conova-03@buildd.debian.org>
Changed-By: Roberto C. Sanchez <roberto@connexer.com>
Description:
 libbson-1.0-0t64 - Library to parse and generate BSON documents - runtime files
 libbson-dev - Library to parse and generate BSON documents - dev files
 libmongoc-1.0-0t64 - MongoDB C client library - runtime files
 libmongoc-dev - MongoDB C client library - dev files
Changes:
 mongo-c-driver (1.30.4-1+deb13u5) trixie; urgency=medium
 .
   * Fix CVE-2026-84965: heap write primitive via size round-up wrap during JSON
     parsing on 32-bit builds
   * Fix CVE-2026-84963: silent field truncation via unchecked int cast of huge
     JSON string values in JSON-to-BSON parser
   * Fix CVE-2026-84964: heap corruption via OCSP request double free from
     crafted multi-URL certificate in TLS client
   * Fix CVE-2026-84969: heap overflow via truncated base64 encoding of binary
     fields in length-limited JSON output
   * Fix CVE-2026-88035: heap buffer overflow via wrapped size check during SASL
     username canonicalization
   * Fix CVE-2026-88036: GridFS data disclosure and deletion via query-operator
     injection in file IDs
   * Fix CVE-2026-93394: SCRAM nonce validation bypass
   * Fix CVE-2026-96746: heap buffer overflow via mid-scan command list growth
     in client topology monitoring
   * Fix CVE-2026-106428: out-of-bounds read in SCRAM authentication response
     parsing
   * Fix CVE-2026-106431: one-byte heap buffer overflow in BSON bulk document
     writer
   * Fix CVE-2026-106438: silent Decimal128 value corruption via incorrect
     exactness check
   * Fix CVE-2026-106437: out-of-bounds read and write via undersized BSON
     buffer reservation
   * Fix CVE-2026-120955: application abort on malformed GridFS metadata
   * Fix CVE-2026-120678: leaks the decompressed reply buffer when an
     OP_COMPRESSED reply fails to parse (denial of service)
   * Fix CVE-2026-120684: GridFS gap lets a shared writer recover a protected
     client's password
   * Fix CDRIVER-6401: abort in cursor namespace parsing when no dot separator
     (required by CVE-2026-120956 fix)
   * Fix CVE-2026-120956: remote abort and memory disclosure from a malformed
     cursor.ns
   * Fix CDRIVER-6523: mandate raising writeConcernError (change SHOULD to MUST)
     + this fixes a potential loss of data by ensuring that a WCE reported by
       the server is propagated rather than discarded
Checksums-Sha1:
 68e87c14752cfdbbe315b15ce9343ff405a855e0 303484 libbson-1.0-0t64-dbgsym_1.30.4-1+deb13u5_armhf.deb
 155dc3362c30e612c4e77a369c76f33a27fa9507 82560 libbson-1.0-0t64_1.30.4-1+deb13u5_armhf.deb
 d5ae1a77df9b07cb50975e9b485f4659cb336abe 144640 libbson-dev_1.30.4-1+deb13u5_armhf.deb
 616d7c06b8bfb5707e8e02ea66762434295d9d78 1614916 libmongoc-1.0-0t64-dbgsym_1.30.4-1+deb13u5_armhf.deb
 1c46abd971b39da21a39563d0dbf85ea307d50d9 356148 libmongoc-1.0-0t64_1.30.4-1+deb13u5_armhf.deb
 00fed6c24836c1fb5c25de9cba857fdcd1a55fc7 446512 libmongoc-dev_1.30.4-1+deb13u5_armhf.deb
 d54a383a590993dfae563e466d593c5c3f2e038c 10393 mongo-c-driver_1.30.4-1+deb13u5_armhf-buildd.buildinfo
Checksums-Sha256:
 4ea53bf19c218d49f47d377893e9db6c54165adb64a7c573fac0103b3d14bc96 303484 libbson-1.0-0t64-dbgsym_1.30.4-1+deb13u5_armhf.deb
 a6f4e3fdee1001fd0052f91f328b5c77874e79011e6f23d7e6b594a2a43b2e96 82560 libbson-1.0-0t64_1.30.4-1+deb13u5_armhf.deb
 d5832d7e8b0d4f87f19f294332224ff418636fce8dfdf63a0bb8e55911cd7c02 144640 libbson-dev_1.30.4-1+deb13u5_armhf.deb
 aca47c97785c4c1f5341ac18dfc05e9f22f23c1b16dbf116d0350af0f7d8fc97 1614916 libmongoc-1.0-0t64-dbgsym_1.30.4-1+deb13u5_armhf.deb
 a24e26424da24781cd0947866bf8350448cf457b2c61e1c11dd60ced88c270b1 356148 libmongoc-1.0-0t64_1.30.4-1+deb13u5_armhf.deb
 0bd7c6f71acf7551a0174ef162499c6393a73442f863e86f9c399da843bcaa7a 446512 libmongoc-dev_1.30.4-1+deb13u5_armhf.deb
 eeed12895dcb66012e393ea21268c2342a93eb93f665a4d97617230a9125eab9 10393 mongo-c-driver_1.30.4-1+deb13u5_armhf-buildd.buildinfo
Files:
 9d9e871643f604cb3e44a54fcc1a6115 303484 debug optional libbson-1.0-0t64-dbgsym_1.30.4-1+deb13u5_armhf.deb
 ac608c0e9a8ba9adcd18d0dda600d119 82560 libs optional libbson-1.0-0t64_1.30.4-1+deb13u5_armhf.deb
 c4c71e0fcfe078a5ee17d03a87f7a6f1 144640 libdevel optional libbson-dev_1.30.4-1+deb13u5_armhf.deb
 66d1ee1617584e1a0d5696255d30f1a4 1614916 debug optional libmongoc-1.0-0t64-dbgsym_1.30.4-1+deb13u5_armhf.deb
 61cc17f50779e2162380e0cda6f12a99 356148 libs optional libmongoc-1.0-0t64_1.30.4-1+deb13u5_armhf.deb
 16fd3c907b47af1145338122fe7da83e 446512 libdevel optional libmongoc-dev_1.30.4-1+deb13u5_armhf.deb
 f64122cd6da300f407f493a267159e50 10393 libs optional mongo-c-driver_1.30.4-1+deb13u5_armhf-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEElFiH1oZRZh1t4FSiXVp1sEH/1mIFAmr46BMACgkQXVp1sEH/
1mLr4hAAklSuRJWhSEDVuwd4EhxwBZe1vfYQ0Y8QwnUr8spYS+VQ+1pDdR4cUxgh
GFaV02r+0IYF125hLMi7VKg6WsFjT4sb/ilLJES62X5p6mPUcsxazHKXuY+AbtYA
9fKts21+ZPtrX/Sz6gXk9VBRjomJV/7Z1UWc9JDycuBSQXZMEvigfABpI1TUX2ru
uAlqqMvlyhx7tGx/NUnk6wUazKdqfXbywaajKKCbRCy+CPKm2+LzT7sGWFe539pt
u2RkCMmXT6SQNnYVKDdun7hQSqu1MYiwySUkXwzH61ZCj+UBJpxUf+otsffWs8jt
zhaopAnmvvJPJRljyFQAUtXeQ2diS2onQuHbaASZKHRpQtnpD4ZwV0hWfr6P1wrr
iv/c/bcs1nt//LrYdSZJHWQC53Q3oIHaZ5y6x63cTQZ+quu0KpTwOXUJW5mnEQeL
X7Z7aVWa5rUK2K1HStAxqlW7To6bKP39sDC5oJL9694jdKFlF7ZWteIwTGhh6Jjo
iXpwFj2VkThoMha1t2n7FjxGLrUJD+8LHQ3kVPjHzf2PsuSUneTJJ6qQ6TS352n5
9VoBZ6TivftXF2D158Ulnp7+vUkhOxUQgMc/UxBekMMtOnICfTs2ab+OjcPArWIw
5RL2hNjhxAIbs6Vu3sEsVgKgBZARagB6VMcnOv/kvUE1RUW3K5g=
=5bOQ
-----END PGP SIGNATURE-----