diff --git a/README.android b/README.android
index cc43cac..7944ebb 100644
--- a/README.android
+++ b/README.android
@@ -3,6 +3,8 @@
 
 The code in this directory is based on $OPENSSL_VERSION in the file
 openssl.config, and some backported OpenSSL code in crypto/0.9.9-dev.
+See patches/README for more information on how the code differs from
+$OPENSSL_VERSION.
 
 Porting New Versions of OpenSSL.
 --
diff --git a/patches/README b/patches/README
index 98b8b75..3ad05a5 100644
--- a/patches/README
+++ b/patches/README
@@ -34,6 +34,7 @@
 
 bad_version.patch
 
+Addresses CVE-2010-0740 http://www.openssl.org/news/secadv_20100324.txt
 A peer can send us a mal-formed packet and we'll copy its 'version'
 number in order to send an error back. However, if the version number
 is an internal OpenSSL value (like DTLS1_VERSION) then we'll assume