Add references to CVE-2017-18269, CVE-2018-11236, CVE-2018-11237

1 files changed, 11 insertions, 0 deletions

diff --git a/NEWS b/NEWS
index 1577f4310f..e2a6f45121 100644
--- a/NEWS
+++ b/NEWS
@@ -109,6 +109,17 @@ Security related changes:
   the system-provided libidn2 library instead.  Originally reported by Hanno
   Böck and Christian Weisgerber.
 
+  CVE-2017-18269: An SSE2-based memmove implementation for the i386
+  architecture could corrupt memory.  Reported by Max Horn.
+
+  CVE-2018-11236: Very long pathname arguments to realpath function could
+  result in an integer overflow and buffer overflow.  Reported by Alexey
+  Izbyshev.
+
+  CVE-2018-11237: The mempcpy implementation for the Intel Xeon Phi
+  architecture could write beyond the target buffer, resulting in a buffer
+  overflow.  Reported by Andreas Schwab.
+
 The following bugs are resolved with this release:
 
   [The release manager will add the list generated by