Update NEWS

diff --git a/NEWS b/NEWS
index b38d3d7437f7de57d0a85eb3eed7749f4dcda600..3d5359c77778e923092753f75ceb006a4219fa23 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,12 @@ dbus 1.13.6 (UNRELEASED)
 
 Fixes:
 
+• Prevent reading up to 3 bytes beyond the end of a truncated message.
+  This could in principle be an information leak or denial of service
+  on the system bus, but is not believed to be exploitable to crash
+  the system bus or leak interesting information in practice.
+  (fd.o #107332, Simon McVittie)
+
 • Fix build with gcc 8 -Werror=cast-function-type
   (fd.o #107349, Simon McVittie)