X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=CHANGES;h=f5351f857f13c2030a21d0447aa6cee771af9fe6;hp=bc985c517b710677d4c0f0dab4557226575a0bea;hb=732d31beeeb2e2e9f44d05da8387cfeca06b91b8;hpb=f7d2f17a0709abb641799e32a11a2408d733d8ed

diff --git a/CHANGES b/CHANGES
index bc985c517b..f5351f857f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -161,6 +161,10 @@
 
  Changes between 1.0.0a and 1.0.0b  [xx XXX xxxx]
 
+  *) Fix extension code to avoid race conditions which can result in a buffer
+     overrun vulnerability: resumed sessions must not be modified as they can
+     be shared by multiple threads. CVE-2010-3864
+
   *) Fix WIN32 build system to correctly link an ENGINE directory into
      a DLL. 
      [Steve Henson]
@@ -1014,6 +1018,10 @@
   
  Changes between 0.9.8o and 0.9.8p [xx XXX xxxx]
 
+  *) Fix extension code to avoid race conditions which can result in a buffer
+     overrun vulnerability: resumed sessions must not be modified as they can
+     be shared by multiple threads. CVE-2010-3864
+
   *) Fix for double free bug in ssl/s3_clnt.c CVE-2010-2939
      [Steve Henson]