1 files changed, 6 insertions, 0 deletions
diff --git a/NEWS b/NEWS
index 437b9ee00f..2c49212cb5 100644
--- a/NEWS
+++ b/NEWS
@@ -49,6 +49,12 @@ Security related changes:
   it is mentioned here only because of the CVE assignment.)  Reported by
   Qualys.
 
+  CVE-2017-1000409: Buffer overflow in _dl_init_paths due to miscomputation
+  of the number of search path components.  (This is not a security
+  vulnerability per se because no trust boundary is crossed if the fix for
+  CVE-2017-1000366 has been applied, but it is mentioned here only because
+  of the CVE assignment.)  Reported by Qualys.
+
 The following bugs are resolved with this release:
 
   [16750] ldd: Never run file directly.