SECURITY: mention how to get windows-specific CVEs

  workarounds, when the release is out and make sure to credit all

  contributors properly.

- Request a CVE number from distros@openwall[1] when also informing and

  preparing them for the upcoming public security vulnerability announcement -

  attach the advisory draft for information. Note that 'distros' won't accept

  an embargo longer than 19 days.

- Request a CVE number from

  [distros@openwall](http://oss-security.openwall.org/wiki/mailing-lists/distros)

  when also informing and preparing them for the upcoming public security

  vulnerability announcement - attach the advisory draft for information. Note

  that 'distros' won't accept an embargo longer than 19 days and they do not

  care for Windows-specific flaws. For windows-specific flaws, request CVE

  directly from MITRE.

- Update the "security advisory" with the CVE number.

- The security web page on the web site should get the new vulnerability

  mentioned.

[1] = http://oss-security.openwall.org/wiki/mailing-lists/distros

CURL-SECURITY (at haxx dot se)

------------------------------