1 files changed, 14 insertions, 0 deletions
diff --git a/CHANGES b/CHANGES
index 718071229cac..e08637559238 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,20 @@
  OpenSSL CHANGES
  _______________
 
+ Changes between 0.9.8zg and 0.9.8zh [3 Dec 2015]
+
+  *) X509_ATTRIBUTE memory leak
+
+     When presented with a malformed X509_ATTRIBUTE structure OpenSSL will leak
+     memory. This structure is used by the PKCS#7 and CMS routines so any
+     application which reads PKCS#7 or CMS data from untrusted sources is
+     affected. SSL/TLS is not affected.
+
+     This issue was reported to OpenSSL by Adam Langley (Google/BoringSSL) using
+     libFuzzer.
+     (CVE-2015-3195)
+     [Stephen Henson]
+
  Changes between 0.9.8zf and 0.9.8zg [11 Jun 2015]
 
   *) Malformed ECParameters causes infinite loop