From 4d047efdbc55b0d68947cde682e5363d16a66294 Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Tue, 16 Aug 2016 11:15:09 +0200 Subject: Add NEWS entry for CVE-2016-6323 --- ChangeLog | 1 + NEWS | 6 +++++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 505c558121..87fcf32f02 100644 --- a/ChangeLog +++ b/ChangeLog @@ -8,6 +8,7 @@ 2016-08-15 Andreas Schwab [BZ #20435] + CVE-2016-6323 * sysdeps/unix/sysv/linux/arm/setcontext.S (__startcontext): Mark as .cantunwind. diff --git a/NEWS b/NEWS index fe9ff1c451..aaed9e02cf 100644 --- a/NEWS +++ b/NEWS @@ -34,7 +34,11 @@ Version 2.25 Security related changes: - [Add security related changes here] + On ARM EABI (32-bit), generating a backtrace for execution contexts which + have been created with makecontext could fail to terminate due to a + missing .cantunwind annotation. This has been observed to lead to a hang + (denial of service) in some Go applications compiled with gccgo. Reported + by Andreas Schwab. The following bugs are resolved with this release: -- cgit v1.2.1