Don't free ret->data if malloc fails.

[openssl.git] / NEWS

diff --git a/NEWS b/NEWS
index c728ca6ac1488ed84dfb618fbb41fc48cd976776..47376364d74a41b02813060674dc9b3b07250a30 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,9 +5,22 @@
   This file gives a brief overview of the major changes between each OpenSSL
   release. For more details please read the CHANGES file.
 
-  Major changes between OpenSSL 1.0.2f and OpenSSL 1.0.2g [under development]
-
-      o Disable SSLv2 default build, default negotiation and weak ciphers.
+  Major changes between OpenSSL 1.0.2g and OpenSSL 1.0.2h [under development]
+
+      o
+
+  Major changes between OpenSSL 1.0.2f and OpenSSL 1.0.2g [1 Mar 2016]
+
+      o Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
+      o Disable SSLv2 default build, default negotiation and weak ciphers
+        (CVE-2016-0800)
+      o Fix a double-free in DSA code (CVE-2016-0705)
+      o Disable SRP fake user seed to address a server memory leak
+        (CVE-2016-0798)
+      o Fix BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption
+        (CVE-2016-0797)
+      o Fix memory issues in BIO_*printf functions (CVE-2016-0799)
+      o Fix side channel attack on modular exponentiation (CVE-2016-0702)
 
   Major changes between OpenSSL 1.0.2e and OpenSSL 1.0.2f [28 Jan 2016]