1 files changed, 4 insertions, 0 deletions
diff --git a/NEWS b/NEWS
index b3fd3cc2ec..2341697c97 100644
--- a/NEWS
+++ b/NEWS
@@ -48,6 +48,10 @@ Security related changes:
   called with the GLOB_ALTDIRFUNC flag and encountered a long file name.
   Reported by Alexander Cherepanov.  (CVE-2016-1234)
 
+* The Sun RPC UDP client could exhaust all available stack space when
+  flooded with crafted ICMP and UDP messages.  Reported by Aldy Hernandez'
+  alloca plugin for GCC.  (CVE-2016-4429)
+
 The following bugs are resolved with this release:
 
   [The release manager will add the list generated by