./Configure: libcrypto.a can grow to many GB on Solaris 10, because of ar bug

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 1e2f31277fa53e7a954d117f27f82a908023ab80..abe3b493470314bffff120ab31dd7ef30b78de5a 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,7 +2,24 @@
  OpenSSL CHANGES
  _______________
 
- Changes between 1.0.1b and 1.0.1c [xx XXX xxxx]
+ Changes between 1.0.1c and 1.0.1d [xx XXX xxxx]
+
+  *) Fix possible deadlock when decoding public keys.
+     [Steve Henson]
+
+  *) Don't use TLS 1.0 record version number in initial client hello
+     if renegotiating.
+     [Steve Henson]
+
+ Changes between 1.0.1b and 1.0.1c [10 May 2012]
+
+  *) Sanity check record length before skipping explicit IV in TLS
+     1.2, 1.1 and DTLS to fix DoS attack.
+
+     Thanks to Codenomicon for discovering this issue using Fuzz-o-Matic
+     fuzzing as a service testing platform.
+     (CVE-2012-2333)
+     [Steve Henson]
 
   *) Initialise tkeylen properly when encrypting CMS messages.
      Thanks to Solar Designer of Openwall for reporting this issue.