Changes: Document heap use-after-free

libexpat · Sep 11, 2022 · 1f25d68 · 1f25d68
1 parent 32b1710
commit 1f25d68
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/expat/Changes b/expat/Changes
@@ -3,6 +3,11 @@ NOTE: We are looking for help with a few things:
       If you can help, please get in touch.  Thanks!
 
 Release x.x.x xxx xxxxx xx xxxx
+        Security fixes:
+       #629 #640  CVE-TODO -- Heap use-after-free vulnerability in function
+                              doContent.  Expected impact is denial of service
+                              or potentially arbitrary code execution.
+
         Bug fixes:
             #634  MinGW: Fix mis-compilation for -D__USE_MINGW_ANSI_STDIO=0
 
@@ -36,9 +41,13 @@ Release x.x.x xxx xxxxx xx xxxx
 
         Special thanks to:
             David Faure
+            Felix Wilhelm
             Frank Bergmann
+            Rhodri James
             Rosen Penev
             Vincent Torri
+                 and
+            Google Project Zero
 
 Release 2.4.8 Mon March 28 2022
         Other changes: