diff --git a/putty.changes b/putty.changes
index 1805b19..86620af 100644
--- a/putty.changes
+++ b/putty.changes
@@ -5,9 +5,9 @@ Tue Oct  1 07:43:23 UTC 2019 - Jan Engelhardt <jengelh@inai.de>
   * In bracketed paste mode, the terminal escape sequences that
     should delimit the pasted data were appearing together on one
     side of it, making it possible to misidentify pasted data as
-    manual keyboard input.
+    manual keyboard input. [CVE-2019-17068, boo#1152753]
   * An SSH-1 server sending a disconnection message could cause
-    an access to freed memory.
+    an access to freed memory. [CVE-2019-17069]
   * Tweaked terminal handling to prevent lost characters at the
     ends of lines in gcc's colored error messages.
   * Removed a bad interaction between the "clear scrollback"