Update NEWS for 1.6.17

Release notes for OpenAFS 1.6.17

Change-Id: I47281bcdb6074a5ab6ba493abf86c1efb2227674

diff --git a/NEWS b/NEWS
index 803afd452466088ce91c7a1a266e727ce44d7883..748c643eacc81de67467a9eaef6660ddf746494c 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,32 @@
                        User-Visible OpenAFS Changes
 
+OpenAFS 1.6.17 (Security Release)
+
+  All server platforms
+
+    * Fix for OPENAFS-SA-2016-001: foreign users can create groups as
+      if they were an administrator (RT #132822) (CVE-2016-2860)
+
+  All client platforms
+
+    * Fix for OPENAFS-SA-2016-002: information leakage from sending
+      uninitialized memory over the network.  Multiple call sites
+      were vulnerable, with potential for leaking both kernel and
+      userland stack data (RT #132847)
+
+    * Update to the GCO CellServDB update from 01 January 2016 (12188)
+
+  Linux clients
+
+    * Fix a crash when the root volume is not found and dynroot is not
+      in use, a regression introduced in 1.6.14.1 (12166)
+
+    * Avoid introducing a dependency on the kernel-devel package corresponding
+      to the currently running system while building the srpm (12195)
+
+    * Create systemd unit files with mode 0644 instead of 0755
+      (12196) (RT #132662)
+
 OpenAFS 1.6.16
 
   All platforms