Added item about the webbrowser security fix.

diff --git a/Misc/NEWS b/Misc/NEWS
index 4429f8e04ad8a10f722b84fe4d8707a07776bb48..fd552ed4af59c5cdecd0f46cfdf2bfbb9d142982 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -22,6 +22,10 @@ Library
   "anonymous@" as default password, rather than the real user and host
   name.
 
+- webbrowser: tightened up the command passed to os.system() so that
+  arbitrary shell code can't be executed because a bogus URL was
+  passed in.
+
 Tools/Demos
 
 Build