CVE-2010-4180 fix (from OpenSSL_1_0_0-stable)

CHANGES

diff --git a/CHANGES b/CHANGES
index 7c44f0d..f063349 100644
--- a/CHANGES
+++ b/CHANGES
@@ -175,6 +175,11 @@
 
  Changes between 1.0.0b and 1.0.0c  [2 Dec 2010]
 
+  *) Disable code workaround for ancient and obsolete Netscape browsers
+     and servers: an attacker can use it in a ciphersuite downgrade attack.
+     Thanks to Martin Rex for discovering this bug. CVE-2010-4180
+     [Steve Henson]
+
   *) Fixed J-PAKE implementation error, originally discovered by
      Sebastien Martini, further info and confirmation from Stefan
      Arentz and Feng Hao. Note that this fix is a security fix. CVE-2010-4252