update NEWS

NEWS

@@ -13,20 +13,22 @@ PHP                                                                        NEWS
   . Fixed bug #62172 (FPM not working with Apache httpd 2.4 balancer/fcgi setup).
     (Matt Haught, Remi)
 
-- PCRE:
-  . Upgraded bundled PCRE library to 8.38.
-
 - Standard:
   . Fixed bug #70720 (strip_tags improper php code parsing). (Julien)
 
 04 Feb 2016, PHP 5.6.18
 
 - Core:
-  . Fixed bug #71201 (round() segfault on 64-bit builds). (Anatol)
+  . Fixed bug #71039 (exec functions ignore length but look for NULL termination).
+    (Anatol)
   . Fixed bug #71089 (No check to duplicate zend_extension). (Remi)
+  . Fixed bug #71201 (round() segfault on 64-bit builds). (Anatol)
   . Added support for new HTTP 451 code. (Julien)
   . Fixed bug #71273 (A wrong ext directory setup in php.ini leads to crash).
-    (Anatol);
+    (Anatol)
+  . Fixed bug #71323 (Output of stream_get_meta_data can be falsified by its
+    input). (Leo Gaspard)
+  . Fixed bug #71459 (Integer overflow in iptcembed()). (Stas)
 
 - Apache2handler:
   . Fix >2G Content-Length headers in apache2handler. (Adam Harvey)
@@ -40,6 +42,15 @@ PHP                                                                        NEWS
   . Fixed bug #71024 (Unable to use PHP 7.0 x64 side-by-side with PHP 5.6 x32
     on the same server). (Anatol)
 
+- PCRE:
+  . Upgraded bundled PCRE library to 8.38.
+
+- Phar:
+  . Fixed bug #71354 (Heap corruption in tar/zip/phar parser). (Stas)
+  . Fixed bug #71391 (NULL Pointer Dereference in phar_tar_setupmetadata()).
+    (Stas)
+  . Fixed bug #71488 (Stack overflow when decompressing tar archives). (Stas)
+
 - Session:
   . Fixed bug #69111 (Crash in SessionHandler::read()). (Anatol)
 
@@ -50,6 +61,9 @@ PHP                                                                        NEWS
   . Fixed bug #71204 (segfault if clean spl_autoload_funcs while autoloading).
     (Laruence)
 
+- WDDX:
+  . Fixed bug #71335 (Type Confusion in WDDX Packet Deserialization). (Stas)
+
 07 Jan 2016, PHP 5.6.17
 
 - Core: