Added release notes for python-pillow#8837

Author: radarhere

docs/releasenotes/11.2.0.rst

@@ -4,15 +4,12 @@
 Security
 ========
 
-TODO
-^^^^
+Undefined shift when loading BC1 DDS images
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-TODO
-
-:cve:`YYYY-XXXXX`: TODO
-^^^^^^^^^^^^^^^^^^^^^^^
-
-TODO
+When loading BC1 DDS images, an integer was bitshifted by 24 places to generate the 32
+bits of the lookup table. This was undefined behaviour, and has been present since
+Pillow 3.4.0.
 
 Deprecations
 ============