X-Git-Url: https://mattmccutchen.net/rsync/rsync.git/blobdiff_plain/e2dd78f7442ce404608fdad6e064d86386e81013..18b72cc8294b4b07bf1373154d2effc35eb10343:/NEWS

diff --git a/NEWS b/NEWS
index b90a9c37..ea81bf89 100644
--- a/NEWS
+++ b/NEWS
@@ -1,8 +1,8 @@
-rsync 2.5.3 (not released yet)
+rsync 2.5.3 (11 March 2002)
 
-  SECURITY FIXES:
+  "Happy 26"
 
-    * (CVE CAN-2002-0059)
+  SECURITY FIXES:
 
     * Make sure that supplementary groups are removed from a server
       process after changing uid and gid. (Ethan Benson) (Debian bug
@@ -10,6 +10,9 @@ rsync 2.5.3 (not released yet)
 
   BUG FIXES:
 
+    * Fix zlib double-free bug.  (Owen Taylor, Mark J Cox) (CVE
+      CAN-2002-0059)
+
     * Fixed problem that in many cases caused the error message 
 	unexpected read size of 0 in map_ptr
       and resulted in the wrong data being copied.
@@ -28,6 +31,10 @@ rsync 2.5.3 (not released yet)
 
   ENHANCEMENTS:
 
+    * Merge in changes from zlib 1.1.2 to zlib 1.1.3.  (Note that
+      rsync still uses a custom version of zlib; you can not just link
+      against a system library.  See zlib/README.rsync)
+
     * Command to initiate connections is only shown with -vv, rather
       than -v as in 2.5.2.  Output from plain -v is more similar to
       what was historically used so as not to break scripts that try