release: release notes for 2.95.2

Release created with releng/create_release.xsh

Change-Id: I8f7770c1a04ccac61a5c40d2453af28ad2810594

doc/manual/rl-next/unsigned-overflow-vuln.md

@@ -1,28 +0,0 @@
----
-synopsis: "Fix unsigned overflow leading to out-of-band write in the NAR parser"
-cls: [5550]
-category: "Fixes"
-credits: [horrors, raito, edef, sandydoo]
-issues: []
----
-
-The NAR parser contained an unsigned integer overflow that could be used by an
-attacker to write arbitrary data to an unknown memory location and possibly
-achieve code execution. A successful attack on the system-wide Lix daemon
-could lead to privilege escalation to root. Any process that involves NAR
-serialization could trigger this issue, including (but not limited to)
-
-  - local user interaction, whether the users are trusted or untrusted
-  - malicious substituters sending malformed NARs
-  - remote builders sending malformed build results
-  - remote daemons sending malformed inputs when requesting remote builds
-
-Successful attacks using this bug require ASLR weakening of some sort, whether
-by architecture constraints (e.g. on 32 bit systems, where little randomization
-is possible) or system configuration (e.g. low ASLR entropy when loading
-libraries), and millions of attempts. Local attacks can be mounted in less than
-an hour. Remote builds typically require a fresh SSH connection for each build
-and are thus less susceptible. Only one attempt can be made by substituters for
-every build using substituters, they are thus not a likely vector for attacks.
-
-At the time of writing, MITRE has not assigned this a CVE yet.

doc/manual/src/release-notes/rl-2.95.md

@@ -1,4 +1,35 @@
 # Lix 2.95 "Kakigōri" (2026-03-13)
+# Lix 2.95.2 (2026-05-04)
+## Fixes
+
+- Fix unsigned overflow leading to out-of-band write in the NAR parser [cl/5550](https://gerrit.lix.systems/c/lix/+/5550)
+
+  The NAR parser contained an unsigned integer overflow that could be used by an
+  attacker to write arbitrary data to an unknown memory location and possibly
+  achieve code execution. A successful attack on the system-wide Lix daemon
+  could lead to privilege escalation to root. Any process that involves NAR
+  serialization could trigger this issue, including (but not limited to)
+
+    - local user interaction, whether the users are trusted or untrusted
+    - malicious substituters sending malformed NARs
+    - remote builders sending malformed build results
+    - remote daemons sending malformed inputs when requesting remote builds
+
+  Successful attacks using this bug require ASLR weakening of some sort, whether
+  by architecture constraints (e.g. on 32 bit systems, where little randomization
+  is possible) or system configuration (e.g. low ASLR entropy when loading
+  libraries), and millions of attempts. Local attacks can be mounted in less than
+  an hour. Remote builds typically require a fresh SSH connection for each build
+  and are thus less susceptible. Only one attempt can be made by substituters for
+  every build using substituters, they are thus not a likely vector for attacks.
+
+  At the time of writing, MITRE has not assigned this a CVE yet.
+
+  Many thanks to [eldritch horrors](https://git.lix.systems/pennae), [Raito Bezarius](https://git.lix.systems/raito), [edef](https://github.com/edef1c), and [sandydoo](https://github.com/sandydoo) for this.
+
+
+
+
 # Lix 2.95.1 (2026-03-19)
 ## Fixes