From b5658f4d9c3d024fd93644f58fb0b47c7e0fa78e Mon Sep 17 00:00:00 2001 From: Miroslav Lichvar Date: Wed, 31 Jul 2013 15:04:12 +0200 Subject: [PATCH] Update NEWS --- NEWS | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/NEWS b/NEWS index cdb3934..8cc9061 100644 --- a/NEWS +++ b/NEWS @@ -1,3 +1,17 @@ +New in version 1.29 +=================== + +Security fixes +-------------- +* Fix crash when processing crafted commands (CVE-2012-4502) + (possible with IP addresses allowed by cmdallow and localhost) +* Don't send uninitialized data in SUBNETS_ACCESSED and CLIENT_ACCESSES + replies (CVE-2012-4503) (not used by chronyc) + +Other changes +------------- +* Drop support for SUBNETS_ACCESSED and CLIENT_ACCESSES commands + New in version 1.28 ===================