News about zlib-1.1.4.

diff --git a/Misc/NEWS b/Misc/NEWS
index 6611c5dcd09e5da2b8ed6fd3989fa1df468aff2e..3f1abd89c8dfc0d59abd6857fa7e38260c062518 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -20,6 +20,11 @@ Core and builtins
 
 Extension modules
 
+- A security hole ("double free") was found in zlib-1.1.3, a popular
+  third party compression library used by some Python modules.  The
+  hole was quickly plugged in zlib-1.1.4, and the Windows build of
+  Python now ships with zlib-1.1.4.
+
 - pwd and grp return enhanced tuples now, with symbolic field names.
 
 - array.array is now a type object. A new format character