From: Mike Brady <mikebrady@eircom.net>
Date: Thu, 23 Nov 2017 15:37:44 +0000 (+0000)
Subject: Update RELEASENOTES.md
X-Git-Tag: 3.1.4~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=43cb36e975a0e07b336855703bd0c81f838437dd;p=thirdparty%2Fshairport-sync.git

Update RELEASENOTES.md
---

diff --git a/RELEASENOTES.md b/RELEASENOTES.md
index 0e8fa37d..49054a06 100644
--- a/RELEASENOTES.md
+++ b/RELEASENOTES.md
@@ -1,3 +1,11 @@
+Version 3.1.4
+====
+
+**Security Update**
+
+* The version of `tinysvcmdns` bundled in Shairport Sync has a buffer overflow bug: *"An exploitable heap overflow vulnerability exists in the tinysvcmdns library version 2016-07-18. A specially crafted packet can make the library overwrite an arbitrary amount of data on the heap with attacker controlled values. An attacker needs send a dns packet to trigger this vulnerability."* The vulnerability is addressed  by additional checking on packet sizes. See also [Vulnerability in tinysvcmdns](https://bugs.launchpad.net/ubuntu/+source/shairport-sync/+bug/1729668). CVE-2017-12087.
+Thanks and [Chris Boot](https://github.com/bootc) for fixing this bug. 
+
 **Bug Fix**
 
 * Somewhere in version 3.x, the `softvol` plugin got broken as the volume change is not applied anymore. Turned out for the `softvol` plugin no `volume()` and `parameters()` are defined. Thanks to [Jörg Krause](https://github.com/joerg-krause) for locating and fixing this bug.