1 files changed, 4 insertions, 0 deletions
diff --git a/NEWS b/NEWS
index 95f368340b..1b59e519ab 100644
--- a/NEWS
+++ b/NEWS
@@ -164,6 +164,10 @@ Security related changes:
   CVE-2017-1000366 has been applied, but it is mentioned here only because
   of the CVE assignment.)  Reported by Qualys.
 
+  CVE-2017-16997: Incorrect handling of RPATH or RUNPATH containing $ORIGIN
+  for AT_SECURE or SUID binaries could be used to load libraries from the
+  current directory.
+
 The following bugs are resolved with this release:
 
   [The release manager will add the list generated by