Try to merge across changes in zlib from 1.1.2 to 1.1.3.

[rsync/rsync.git] / NEWS

diff --git a/NEWS b/NEWS
index 8e76d34..7fcb24e 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,8 +2,11 @@ rsync 2.5.3 (not released yet)
 
   SECURITY FIXES:
 
+    * (CVE CAN-2002-0059)
+
     * Make sure that supplementary groups are removed from a server
-      process after changing uid and gid. (Ethan Benson)
+      process after changing uid and gid. (Ethan Benson) (Debian bug
+      #132272, CVE CAN-2002-0080)
 
   BUG FIXES:
 
@@ -25,6 +28,10 @@ rsync 2.5.3 (not released yet)
 
   ENHANCEMENTS:
 
+    * Merge in changes from zlib 1.1.2 to zlib 1.1.3.  (Note that
+      rsync still uses a custom version of zlib; you can not just link
+      against a system library.  See zlib/README.rsync)
+
     * Command to initiate connections is only shown with -vv, rather
       than -v as in 2.5.2.  Output from plain -v is more similar to
       what was historically used so as not to break scripts that try