diff --git a/xen.spec b/xen.spec
index 5c16b79..45954c2 100644
--- a/xen.spec
+++ b/xen.spec
@@ -889,7 +889,7 @@ fi
 	(#1652251)
 
 * Tue Nov 06 2018 Michael Young <m.a.young@durham.ac.uk> - 4.10.2-3
-- guest use of HLE constructs may lock up host [XSA-282]
+- guest use of HLE constructs may lock up host [XSA-282, CVE-2018-19967]
 
 * Thu Oct 25 2018 Michael Young <m.a.young@durham.ac.uk> - 4.10.2-2
 - x86: Nested VT-x usable even when disabled [XSA-278, CVE-2018-18883]