Fix NEWS for 5.5.11 fix (really not in 5.5.10)
Add CVE ref (not known at release time)
Fix order in NEWS