Update NEWS

diff --git a/ChangeLog b/ChangeLog
index 5a90364f9045ea9dc6c5efd12fe28b2b97cd2582..a8539a370502801b2362b291fd4d432d8d09e3f5 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2017-08-01  Siddhesh Poyarekar  <siddhesh@sourceware.org>
+
+       * NEWS: Update security-related changes.
+
 2017-07-30  Siddhesh Poyarekar  <siddhesh@sourceware.org>
 
        * po/be.po: Update translations.

diff --git a/NEWS b/NEWS
index ab0fb545f8998bc239a1b62d4d7d8abdc52ae597..bd48d18158f5da85a1f1df193f2b1a4d1f064d8b 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -194,7 +194,17 @@ Changes to build and runtime requirements:
 Security related changes:
 
 * The DNS stub resolver limits the advertised UDP buffer size to 1200 bytes,
-  to avoid fragmentation-based spoofing attacks.
+  to avoid fragmentation-based spoofing attacks (CVE-2017-12132).
+
+* LD_LIBRARY_PATH is now ignored in binaries running in privileged AT_SECURE
+  mode to guard against local privilege escalation attacks (CVE-2017-1000366).
+
+* Avoid printing a backtrace from the __stack_chk_fail function since it is
+  called on a corrupt stack and a backtrace is unreliable on a corrupt stack
+  (CVE-2010-3192).
+
+* A use-after-free vulnerability in clntudp_call in the Sun RPC system has been
+  fixed (CVE-2017-12133).
 
 The following bugs are resolved with this release: