Update CHANGES and NEWS for the new release

Reviewed-by: Richard Levitte <levitte@openssl.org>

diff --git a/CHANGES b/CHANGES
index c07237917d57b7140585332eb1d6e9ee27ebffa9..b1787541ef26f118e6afd93f66caf61d65c1ef37 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,7 +4,15 @@
 
  Changes between 1.0.2i and 1.0.2j [xx XXX xxxx]
 
-  *)
+  *) Missing CRL sanity check
+
+     A bug fix which included a CRL sanity check was added to OpenSSL 1.1.0
+     but was omitted from OpenSSL 1.0.2i. As a result any attempt to use
+     CRLs in OpenSSL 1.0.2i will crash with a null pointer exception.
+
+     This issue only affects the OpenSSL 1.0.2i
+     (CVE-2016-7052)
+     [Matt Caswell]
 
  Changes between 1.0.2h and 1.0.2i [22 Sep 2016]
 

diff --git a/NEWS b/NEWS
index 6a787e69ec73d6f682525e0250376690430bf268..412a2effc76c0fad596d3d7ebaaba76cff78c30a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -7,7 +7,7 @@
 
   Major changes between OpenSSL 1.0.2i and OpenSSL 1.0.2j [under development]
 
-      o
+      o Fix Use After Free for large message sizes (CVE-2016-6309)
 
   Major changes between OpenSSL 1.0.2h and OpenSSL 1.0.2i [22 Sep 2016]