1 files changed, 5 insertions, 0 deletions
diff --git a/NEWS b/NEWS
index abbe561..eef51b6 100644
--- a/NEWS
+++ b/NEWS
@@ -125,6 +125,11 @@ Security related changes:
   instead of NULL.  This was a regression introduced with the new malloc
   thread cache in glibc 2.26.  Reported by Iain Buclaw.
 
+  CVE-2017-1000408: Incorrect array size computation in _dl_init_paths leads
+  to the allocation of too much memory.  (This is not a security bug per se,
+  it is mentioned here only because of the CVE assignment.)  Reported by
+  Qualys.
+
 The following bugs are resolved with this release:
 
   [The release manager will add the list generated by