From: Carlos O'Donell Date: Mon, 6 Feb 2023 15:36:32 +0000 (-0500) Subject: NEWS: Document CVE-2023-25139. X-Git-Tag: glibc-2.38~603 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=67c37737ed474d25fd4dc535dfd822c426e6b971;p=thirdparty%2Fglibc.git NEWS: Document CVE-2023-25139. Reviewed-by: Siddhesh Poyarekar --- diff --git a/NEWS b/NEWS index b227e72c9cc..a7979a9cd33 100644 --- a/NEWS +++ b/NEWS @@ -21,7 +21,12 @@ Changes to build and runtime requirements: Security related changes: - [Add security related changes here] + CVE-2023-25139: When the printf family of functions is called with a + format specifier that uses an (enable grouping) and a + minimum width specifier, the resulting output could be larger than + reasonably expected by a caller that computed a tight bound on the + buffer size. The resulting larger than expected output could result + in a buffer overflow in the printf family of functions. The following bugs are resolved with this release: