1 files changed, 6 insertions, 1 deletions
diff --git a/NEWS b/NEWS
index 0792f31523..ce6a54fe63 100644
--- a/NEWS
+++ b/NEWS
@@ -7,7 +7,12 @@
 
   Major changes between OpenSSL 1.1.0 and OpenSSL 1.1.0a [under development]
 
-      o
+      o OCSP Status Request extension unbounded memory growth (CVE-2016-6304)
+      o SSL_peek() hang on empty record (CVE-2016-6305)
+      o Excessive allocation of memory in tls_get_message_header()
+       (CVE-2016-6307)
+      o Excessive allocation of memory in dtls1_preprocess_fragment()
+       (CVE-2016-6308)
 
   Major changes between OpenSSL 1.0.2h and OpenSSL 1.1.0 [25 Aug 2016]