Add CVE-2013-4332 to NEWS.

diff --git a/NEWS b/NEWS
index 96df7a960a796dc0a5f75f0f67356f139a9d3cbd..e2931f13c4c0bc8684d2d8a21dad7063131a6d1e 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -22,6 +22,11 @@ Version 2.18.1
 * CVE-2013-4458 Stack overflow in getaddrinfo with large number of results
   for AF_INET6 has been fixed (Bugzilla #16072).
 
+* CVE-2013-4332 The pvalloc, valloc, memalign, posix_memalign and
+  aligned_alloc functions could allocate too few bytes or corrupt the
+  heap when passed very large allocation size values (Bugzilla #15855,
+  #15856, #15857).
+
 * CVE-2012-4424 The strcoll implementation uses malloc to cache indices and
   rules for large collation sequences to optimize multiple passes and falls
   back to alloca if malloc fails, resulting in a possible stack overflow.