Don't free ret->data if malloc fails.

[openssl.git] / NEWS

diff --git a/NEWS b/NEWS
index 5b7e2ec3edbffe574f1d51bbe8d09fa9b6012d42..47376364d74a41b02813060674dc9b3b07250a30 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,7 +5,24 @@
   This file gives a brief overview of the major changes between each OpenSSL
   release. For more details please read the CHANGES file.
 
-  Major changes between OpenSSL 1.0.2e and OpenSSL 1.0.2f [under development]
+  Major changes between OpenSSL 1.0.2g and OpenSSL 1.0.2h [under development]
+
+      o
+
+  Major changes between OpenSSL 1.0.2f and OpenSSL 1.0.2g [1 Mar 2016]
+
+      o Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
+      o Disable SSLv2 default build, default negotiation and weak ciphers
+        (CVE-2016-0800)
+      o Fix a double-free in DSA code (CVE-2016-0705)
+      o Disable SRP fake user seed to address a server memory leak
+        (CVE-2016-0798)
+      o Fix BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption
+        (CVE-2016-0797)
+      o Fix memory issues in BIO_*printf functions (CVE-2016-0799)
+      o Fix side channel attack on modular exponentiation (CVE-2016-0702)
+
+  Major changes between OpenSSL 1.0.2e and OpenSSL 1.0.2f [28 Jan 2016]
 
       o DH small subgroups (CVE-2016-0701)
       o SSLv2 doesn't block disabled ciphers (CVE-2015-3197)