compile cts128.c on VMS

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 2944acae7568b8b926c46c473cb700bb856de1dd..f5351f857f13c2030a21d0447aa6cee771af9fe6 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -161,6 +161,10 @@
 
  Changes between 1.0.0a and 1.0.0b  [xx XXX xxxx]
 
+  *) Fix extension code to avoid race conditions which can result in a buffer
+     overrun vulnerability: resumed sessions must not be modified as they can
+     be shared by multiple threads. CVE-2010-3864
+
   *) Fix WIN32 build system to correctly link an ENGINE directory into
      a DLL. 
      [Steve Henson]
@@ -173,9 +177,6 @@
 
  Changes between 0.9.8n and 1.0.0  [29 Mar 2010]
 
-  *) Fix for double free bug in ssl/s3_clnt.c CVE-2010-2939
-     [Steve Henson]
-
   *) Add "missing" function EVP_CIPHER_CTX_copy(). This copies a cipher
      context. The operation can be customised via the ctrl mechanism in
      case ENGINEs want to include additional functionality.
@@ -1017,6 +1018,13 @@
   
  Changes between 0.9.8o and 0.9.8p [xx XXX xxxx]
 
+  *) Fix extension code to avoid race conditions which can result in a buffer
+     overrun vulnerability: resumed sessions must not be modified as they can
+     be shared by multiple threads. CVE-2010-3864
+
+  *) Fix for double free bug in ssl/s3_clnt.c CVE-2010-2939
+     [Steve Henson]
+
   *) Don't reencode certificate when calculating signature: cache and use
      the original encoding instead. This makes signature verification of
      some broken encodings work correctly.