1 files changed, 5 insertions, 0 deletions
diff --git a/NEWS b/NEWS
index a94650da64..cc4b81f0ac 100644
--- a/NEWS
+++ b/NEWS
@@ -64,6 +64,11 @@ Security related changes:
   an application calls getaddrinfo for AF_INET6 with AI_CANONNAME,
   AI_ALL and AI_V4MAPPED flags set.
 
+  CVE-2023-4911: If a tunable of the form NAME=NAME=VAL is passed in the
+  environment of a setuid program and NAME is valid, it may result in a
+  buffer overflow, which could be exploited to achieve escalated
+  privileges.  This flaw was introduced in glibc 2.34.
+
 The following bugs are resolved with this release:
 
   [The release manager will add the list generated by