add CVE and issue number
diff --git a/Misc/NEWS b/Misc/NEWS
index b33c5a4..0eb8153 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -99,8 +99,9 @@
- Issue #21766: Prevent a security hole in CGIHTTPServer by URL unquoting paths
before checking for a CGI script at that path.
-- Fix arbitrary memory access in JSONDecoder.raw_decode with a negative second
- parameter. Bug reported by Guido Vranken.
+- Issue #21529 (CVE-2014-4616): Fix arbitrary memory access in
+ JSONDecoder.raw_decode with a negative second parameter. Bug reported by Guido
+ Vranken.
- Issue #21082: In os.makedirs, do not set the process-wide umask. Note this
changes behavior of makedirs when exist_ok=True.