X-Git-Url: https://git.librecmc.org/?a=blobdiff_plain;ds=sidebyside;f=CHANGES;h=a714dd5cd72ff7679a2f60777e7ab35eb8576daf;hb=fb5a0fb8f11cf08f021dfde290519e3c414bca8c;hp=1ec2697954025e26f4e81dc0a7bd22a774a2fd36;hpb=dde6d9520ce58798149bc0b9920ba1d8971ea86c;p=oweals%2Fopenssl.git

diff --git a/CHANGES b/CHANGES
index 1ec2697954..a714dd5cd7 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2,11 +2,23 @@
  OpenSSL CHANGES
  _______________
 
- Changes between 1.0.0b and 1.0.0c  [xx XXX xxxx]
+ Changes between 1.0.0c and 1.0.0d [xx XXX xxxx]
+
+  *) Fix bug in string printing code: if *any* escaping is enabled we must
+     escape the escape character (backslash) or the resulting string is
+     ambiguous.
+     [Steve Henson]
+
+ Changes between 1.0.0b and 1.0.0c  [2 Dec 2010]
+
+  *) Disable code workaround for ancient and obsolete Netscape browsers
+     and servers: an attacker can use it in a ciphersuite downgrade attack.
+     Thanks to Martin Rex for discovering this bug. CVE-2010-4180
+     [Steve Henson]
 
   *) Fixed J-PAKE implementation error, originally discovered by
      Sebastien Martini, further info and confirmation from Stefan
-     Arentz and Feng Hao. Note that this fix is a security fix.
+     Arentz and Feng Hao. Note that this fix is a security fix. CVE-2010-4252
      [Ben Laurie]
 
  Changes between 1.0.0a and 1.0.0b  [16 Nov 2010]