* CVE-2006-3747 was the main reason to release 2.2.3. So place the changelog

  entry where it belongs.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@476628 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index eb297692a021f75fee0a3775a219610436e9b282..2f13b168a6813701e781b09785a75fb6a44ebc48 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -30,8 +30,8 @@ Changes with Apache 2.3.0
      AcceptMutex directive now takes an optional lockfile
      location parameter, ala SSLMutex. [Jim Jagielski]
 
-  *) Fix address-in-use startup failure caused by corruption of the list of 
-     listen sockets in some configurations with multiple generic Listen 
+  *) Fix address-in-use startup failure caused by corruption of the list of
+     listen sockets in some configurations with multiple generic Listen
      directives.  [Jeff Trawick]
 
   *) mod_authn_dbd: Export any additional columns queried in the SQL select
@@ -73,7 +73,7 @@ Changes with Apache 2.3.0
   *) mod_rewrite: support rewritemap by SQL query [Nick Kew]
 
   *) Fix issue which could cause piped loggers to be orphaned and never
-     terminate after a graceful restart.  PR 40651.  [Joe Orton, 
+     terminate after a graceful restart.  PR 40651.  [Joe Orton,
      Ruediger Pluem]
 
   *) mod_headers: support regexp-based editing of HTTP headers [Nick Kew]
@@ -125,12 +125,6 @@ Changes with Apache 2.3.0
      his value is defined as 258, thus limiting the MaxThreads
      to that value. [Mladen Turk]
 
-  *) SECURITY: CVE-2006-3747 (cve.mitre.org)
-     mod_rewrite: Fix an off-by-one security problem in the ldap scheme
-     handling.  For some RewriteRules this could lead to a pointer being
-     written out of bounds.  Reported by Mark Dowd of McAfee.
-     [Mark Cox]
-
   *) mod_cache: While serving a cached entity ensure that filters that have
      been applied to this cached entity before saving it to the cache are not
      applied again. PR 40090. [Ruediger Pluem]
@@ -345,6 +339,12 @@ Changes with Apache 2.2.4
 
 Changes with Apache 2.2.3
 
+  *) SECURITY: CVE-2006-3747 (cve.mitre.org)
+     mod_rewrite: Fix an off-by-one security problem in the ldap scheme
+     handling.  For some RewriteRules this could lead to a pointer being
+     written out of bounds.  Reported by Mark Dowd of McAfee.
+     [Mark Cox]
+
   *) mod_authn_alias: Add a check to make sure that the base provider and the
      alias names are different and also that the alias has not been registered
      before. PR 40051. [Brad Nicholes]