Updating NEWS for 2.26

[Florian Weimer]

On 07/31/2017 02:13 PM, Siddhesh Poyarekar wrote:
> On Sunday 30 July 2017 05:46 PM, Joseph Myers wrote:
>> On Mon, 3 Jul 2017, Joseph Myers wrote:
>>
>>> The NEWS section for security-related changes in 2.26 seems very 
>>> incomplete, with only a single entry.  It clearly needs to be filled out.  
>>> If people know of other significant changes missing from the main NEWS 
>>> section for 2.26, they should add those as well.
>>
>> Reminder: the security-related section is still almost empty.  This needs 
>> to be fixed before the release.
> 
> This is what I've come up with based on bugzilla.  I'll commit this
> before release if it looks OK.

Also missing:

* A use-after-free vulnerability in clntudp_call in the Sun RPC system
has been fixed.

Thanks,
Florian