From 7d51c06a3b71ff1ec52c6b17d70f5d49f8f9cb99 Mon Sep 17 00:00:00 2001 From: Mike Brady Date: Thu, 23 Nov 2017 15:41:30 +0000 Subject: [PATCH] Update RELEASENOTES.md --- RELEASENOTES.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/RELEASENOTES.md b/RELEASENOTES.md index 49054a06..ab435750 100644 --- a/RELEASENOTES.md +++ b/RELEASENOTES.md @@ -4,7 +4,7 @@ Version 3.1.4 **Security Update** * The version of `tinysvcmdns` bundled in Shairport Sync has a buffer overflow bug: *"An exploitable heap overflow vulnerability exists in the tinysvcmdns library version 2016-07-18. A specially crafted packet can make the library overwrite an arbitrary amount of data on the heap with attacker controlled values. An attacker needs send a dns packet to trigger this vulnerability."* The vulnerability is addressed by additional checking on packet sizes. See also [Vulnerability in tinysvcmdns](https://bugs.launchpad.net/ubuntu/+source/shairport-sync/+bug/1729668). CVE-2017-12087. -Thanks and [Chris Boot](https://github.com/bootc) for fixing this bug. +Thanks and [Chris Boot](https://github.com/bootc) for fixing this bug. **Bug Fix** -- 2.47.3