Merge issue 11662.

diff --cc Misc/NEWS
index bd390a05b466faa5e8df776586072582201cd75b,91d9ce6081e2646efe1286d8d5970c89aea5f3e3..a03477a90d2d92c3aef2d89948267d8a6fb38b6d
--- 1/Misc/NEWS
--- 2/Misc/NEWS
+++ b/Misc/NEWS
@@@ -44,20 -44,9 +44,23 @@@ Core and Builtin
  Library
  -------
  
 +- Issue #11696: Fix ID generation in msilib.
 +
 +- Issue #9696: Fix exception incorrectly raised by xdrlib.Packer.pack_int when
 +  trying to pack a negative (in-range) integer.
 +
 +- Issue #11675: multiprocessing.[Raw]Array objects created from an integer size
 +  are now zeroed on creation.  This matches the behaviour specified by the
 +  documentation.
 +
 +- Issue #7639: Fix short file name generation in bdist_msi.
 +
 +- Issue #11659: Fix ResourceWarning in test_subprocess introduced by #11459.
 +  Patch by Ben Hayden.
 +
+ - Issue #11662: Make urllib and urllib2 ignore redirections if the
+   scheme is not HTTP, HTTPS or FTP (CVE-2011-1521).
+ 
  - Issue #5537: Fix time2isoz() and time2netscape() functions of
    httplib.cookiejar for expiration year greater than 2038 on 32-bit systems.