1 files changed, 3 insertions, 0 deletions
diff --git a/NEWS b/NEWS
index c1159b0..84e0ef0 100644
--- a/NEWS
+++ b/NEWS
@@ -16,6 +16,9 @@ GNU gzip NEWS                                    -*- outline -*-
 
 ** Bug fixes
 
+  zgrep applied to a crafted file name with two or more newlines
+  can no longer overwrite an arbitrary, attacker-selected file.
+
   'zdiff -C 5' no longer misbehaves by treating '5' as a file name.
 
   Configure-time options like --program-prefix now work.