From 4df8479e6b3baf365bd4eedbba922b73471e5d73 Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Thu, 24 May 2018 16:27:38 +0200 Subject: [PATCH] Add NEWS entry for CVE-2018-11236 --- NEWS | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/NEWS b/NEWS index 27548fdb4b2..c6c5538192a 100644 --- a/NEWS +++ b/NEWS @@ -74,6 +74,10 @@ Security related changes: the value of SIZE_MAX, would return a pointer to a buffer which is too small, instead of NULL. + CVE-2018-11236: Very long pathname arguments to realpath function could + result in an integer overflow and buffer overflow. Reported by Alexey + Izbyshev. + CVE-2018-11237: The mempcpy implementation for the Intel Xeon Phi architecture could write beyond the target buffer, resulting in a buffer overflow. Reported by Andreas Schwab. -- 2.47.2