update for next version

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 230535d78199b99fd8fc858bf129057ecc1fa420..0ebe88f2770d9dbc507f9979ac9f931839491d4e 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,10 +2,16 @@
  OpenSSL CHANGES
  _______________
 
- Changes between 1.0.0 and 1.0.0a  [xx XXX xxxx]
+ Changes between 1.0.0a and 1.0.0b  [xx XXX xxxx]
 
   *)
 
+ Changes between 1.0.0 and 1.0.0a  [01 Jun 2010]
+
+  *) Check return value of int_rsa_verify in pkey_rsa_verifyrecover 
+     (CVE-2010-1633)
+     [Steve Henson, Peter-Michael Hager <hager@dortmund.net>]
+
  Changes between 0.9.8n and 1.0.0  [29 Mar 2010]
 
   *) Add "missing" function EVP_CIPHER_CTX_copy(). This copies a cipher
@@ -849,6 +855,10 @@
   
  Changes between 0.9.8n and 0.9.8o [xx XXX xxxx]
 
+  *) Correct a typo in the CMS ASN1 module which can result in invalid memory
+     access or freeing data twice (CVE-2010-0742)
+     [Steve Henson, Ronald Moesbergen <intercommit@gmail.com>]
+
   *) Add SHA2 algorithms to SSL_library_init(). SHA2 is becoming far more
      common in certificates and some applications which only call
      SSL_library_init and not OpenSSL_add_all_algorithms() will fail.