This maintenance release of the 0.5.x series fixes a bug that was always present in the compiler. Some people do not even consider it a bug, though, which might explain why it was undiscovered for so long:
A private function can be overridden in a derived contract by a private function of the same name and types. In other words, the virtual function calling mechanism does not respect visibility.
The same applies to two private functions of the same name and type that are declared in two unrelated base contracts (diamond inheritance).
This bug has been fixed in the 0.6.x series already in version 0.6.0 by making the override mechanism more strict in general.
Bugfixes:
- Type Checker: Disallow overriding of private functions.
Thanks to @k06a for reporting the bug!
If you want to perform a source build, please only use solidity_0.5.17.tar.gz and not the zip provided by github directly.