Merge pull request #3360 from bluca/cve

Problem: NEWS for 4.3.1 does not mention CVE number

Merge pull request #3360 from bluca/cve
Problem: NEWS for 4.3.1 does not mention CVE number
e21988d0 · Constantin Rack · GitHub · 2d025979 · bfba6e5a · e21988d0
Unverified Commit e21988d0 authored Jan 14, 2019 by Constantin Rack Committed by GitHub Jan 14, 2019
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 2 deletions

NEWS NEWS +3 -2

No files found.
--- a/NEWS
+++ b/NEWS
@@ -4,8 +4,9 @@
 0MQ version 4.3.1 stable, released on 2019/01/12
 ================================================

-* A vulnerability has been found that would allow attackers to direct a peer to
-  jump to and execute from an address indicated by the attacker.
+* CVE-2019-6250: A vulnerability has been found that would allow attackers to
+  direct a peer to jump to and execute from an address indicated by the
+  attacker.
  This issue has been present since v4.2.0. Older releases are not affected.
  NOTE: The attacker needs to know in advance valid addresses in the peer's
  memory to jump to, so measures like ASLR are effective mitigations.