X-Git-Url: https://arthur.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git;a=blobdiff_plain;f=NEWS;h=d092510bcffccc7bca357525d226589e968a7c6e;hp=be743e681266239fc91caf1265f7e59b94e4acea;hb=refs%2Fheads%2Fbranch-20.x;hpb=21493731dffa0f5d9f62d24cdef290be6a6856fd

diff --git a/NEWS b/NEWS
index be743e68..d092510b 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,21 @@
                                   -- NEWS --
 
 
+ngIRCd 20.3 (2013-08-23)
+
+  - This release is a bugfix release only, without new features.
+  - Security: Fix a denial of service bug (server crash) which could happen
+    when the configuration option "NoticeAuth" is enabled (which is NOT the
+    default) and ngIRCd failed to send the "notice auth" messages to new
+    clients connecting to the server (CVE-2013-5580).
+
+ngIRCd 20.2 (2013-02-15)
+
+  - This release is a bugfix release only, without new features.
+  - Security: Fix a denial of service bug in the function handling KICK
+    commands that could be used by arbitrary users to to crash the daemon
+    (CVE-2013-1747).
+
 ngIRCd 20.1 (2013-01-02)
 
   - This release is a bugfix release only, without new features.