add CVE for release

git-svn-id: https://svn.apache.org/repos/asf/apr/apr/branches/1.7.x@1920202 13f79535-47bb-0310-9956-ffa450edef68

CHANGES

@@ -3,6 +3,18 @@ Changes for APR 1.7.6
 
 Changes for APR 1.7.5
 
+  *) SECURITY: CVE-2023-49582: Apache Portable Runtime (APR):
+     Unexpected lax shared memory permissions (cve.mitre.org)
+     Lax permissions set by the Apache Portable Runtime library on
+     Unix platforms would allow local users read access to named
+     shared memory segments, potentially revealing sensitive
+     application data.
+     This issue does not affect non-Unix platforms, or builds with
+     APR_USE_SHMEM_SHMGET=1 (apr.h)
+     Users are recommended to upgrade to APR version 1.7.5, which
+     fixes this issue.
+     Credits: Thomas Stangner
+
   *) Unix: Implement apr_shm_perms_set() for the "POSIX shm_open()"
      and "classic mmap" shared memory implementations.  [Joe Orton,
      Ruediger Pluem]