Update RELEASENOTES.md

diff --git a/RELEASENOTES.md b/RELEASENOTES.md
index 0e8fa37dbee68e7d202febf1d0d529341dd231f4..49054a06d9d9484f58f4bf88941067ced3a8ac89 100644 (file)
--- a/RELEASENOTES.md
+++ b/RELEASENOTES.md
@@ -1,3 +1,11 @@
+Version 3.1.4
+====
+
+**Security Update**
+
+* The version of `tinysvcmdns` bundled in Shairport Sync has a buffer overflow bug: *"An exploitable heap overflow vulnerability exists in the tinysvcmdns library version 2016-07-18. A specially crafted packet can make the library overwrite an arbitrary amount of data on the heap with attacker controlled values. An attacker needs send a dns packet to trigger this vulnerability."* The vulnerability is addressed  by additional checking on packet sizes. See also [Vulnerability in tinysvcmdns](https://bugs.launchpad.net/ubuntu/+source/shairport-sync/+bug/1729668). CVE-2017-12087.
+Thanks and [Chris Boot](https://github.com/bootc) for fixing this bug. 
+
 **Bug Fix**
 
 * Somewhere in version 3.x, the `softvol` plugin got broken as the volume change is not applied anymore. Turned out for the `softvol` plugin no `volume()` and `parameters()` are defined. Thanks to [Jörg Krause](https://github.com/joerg-krause) for locating and fixing this bug.