Update NEWS.

* NEWS: Update.

Signed-off-by: Ralf Wildenhues <Ralf.Wildenhues@gmx.de>

ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 6da2f91..d7b91f0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2009-12-08  Ralf Wildenhues  <Ralf.Wildenhues@gmx.de>
+
+	* NEWS: Update.
+
 2009-11-28  Jim Meyering  <meyering@redhat.com>
 
 	do not put world-writable directories in distribution tarballs

NEWS

diff --git a/NEWS b/NEWS
index 604e7a7..9ad0b9b 100644
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,8 @@
 New in 1.4-p6a:
 * The distribution is tarred up with mode 755 now by the `dist*' targets.
+  This fixes a race condition where untrusted users could modify files
+  in the $(PACKAGE)-$(VERSION) distdir before packing if the toplevel
+  build directory was world-searchable.  This is CVE-2009-4029.
 
 New in 1.4-p6:
 * Versioned install support back-ported from 1.6