1 files changed, 6 insertions, 1 deletions
diff --git a/NEWS b/NEWS
index b231e9747f..9f44db061e 100644
--- a/NEWS
+++ b/NEWS
@@ -9,7 +9,12 @@ Version 2.19
 
 * The following bugs are resolved with this release:
 
-  15749
+  14699, 15749
+
+* CVE-2013-4237 The readdir_r function could write more than NAME_MAX bytes
+  to the d_name member of struct dirent, or omit the terminating NUL
+  character.  (Bugzilla #14699).
+
 
 Version 2.18