Update NEWS.
* NEWS: Update.
Signed-off-by: Ralf Wildenhues <Ralf.Wildenhues@gmx.de>
diff --git a/ChangeLog b/ChangeLog
index 760bcb4..35a4fe3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2009-12-08 Ralf Wildenhues <Ralf.Wildenhues@gmx.de>
+
+ * NEWS: Update.
+
2009-11-28 Jim Meyering <meyering@redhat.com>
do not put world-writable directories in distribution tarballs
diff --git a/NEWS b/NEWS
index af79eff..e0b47d7 100644
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,8 @@
New in 1.5.1a:
* The distribution is tarred up with mode 755 now by the `dist*' targets.
+ This fixes a race condition where untrusted users could modify files
+ in the $(PACKAGE)-$(VERSION) distdir before packing if the toplevel
+ build directory was world-searchable. This is CVE-2009-4029.
New in 1.5:
* Support for `configure.ac'.
