mention fix for LZO integer overflow (CVE-2014-4610) in debian/changelog