diff --git a/gzip.changes b/gzip.changes
index d60943d..338e4b0 100644
--- a/gzip.changes
+++ b/gzip.changes
@@ -1,7 +1,7 @@
 -------------------------------------------------------------------
 Sat Apr  9 11:45:49 UTC 2022 - Dirk Müller <dmueller@suse.com>
 
-- update to 1.12:
+- update to 1.12 (CVE-2022-1271,bsc#1198062):
   * 'gzip -l' no longer misreports file lengths 4 GiB and larger.
     Previously, 'gzip -l' output the 32-bit value stored in the gzip
     header even though that is the uncompressed length modulo 2**32.