NEWS: mention CVE-2020-25637 in v6.8.0 release notes

Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>

diff --git a/NEWS.rst b/NEWS.rst
index de46cac8c59d2be6bc590256ff1c67f6d68b2de0..f6074d9fe89999c841beb3be02eb8aee4ae79f92 100644 (file)
--- a/NEWS.rst
+++ b/NEWS.rst
@@ -27,6 +27,14 @@ v6.9.0 (unreleased)
 v6.8.0 (2020-10-01)
 ===================
 
+* **Security**
+
+  * qemu: double free in qemuAgentGetInterfaces() in qemu_agent.c
+
+    Clients connecting to the read-write socket with limited ACL permissions
+    may be able to crash the libvirt daemon, resulting in a denial of service,
+    or potentially escalate their privileges on the system. CVE-2020-25637.
+
 * **New features**
 
   * xen: Add ``writeFiltering`` attribute for PCI devices