diff --git a/git.changes b/git.changes
index 0c44d10..6f6861a 100644
--- a/git.changes
+++ b/git.changes
@@ -13,11 +13,11 @@ Tue Sep 26 07:56:20 UTC 2017 - astieger@suse.com
   * "git svn --localtime" correctness fixes
   * "git grep -L" and "git grep --quiet -L" now report same exit code
   * fixes to "git apply" when converting line endings
-  * "git cvsserver" no longer is invoked by "git daemon" by
-    default bsc#1060377
   * Various Perl scripts did not use safe_pipe_capture() instead 
     of backticks, leaving them susceptible to end-user input.
-    bsc#1060378
+    CVE-2017-14867 bsc#1061041
+  * "git cvsserver" no longer is invoked by "git daemon" by
+    default 
 
 -------------------------------------------------------------------
 Thu Aug 10 19:19:07 UTC 2017 - astieger@suse.com