1 files changed, 5 insertions, 0 deletions
diff --git a/NEWS b/NEWS
index 36da15a922..be1c4ffaee 100644
--- a/NEWS
+++ b/NEWS
@@ -97,6 +97,11 @@ Security related changes:
   an application calls getaddrinfo for AF_INET6 with AI_CANONNAME,
   AI_ALL and AI_V4MAPPED flags set.
 
+  CVE-2023-4911: If a tunable of the form NAME=NAME=VAL is passed in the
+  environment of a setuid program and NAME is valid, it may result in a
+  buffer overflow, which could be exploited to achieve escalated
+  privileges.  This flaw was introduced in glibc 2.34.
+
 
 Version 2.35