update NEWS

Author: smalyshev

NEWS

@@ -6,7 +6,18 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug #71039 (exec functions ignore length but look for NULL termination).
     (Anatol)
+  . Fixed bug #71323 (Output of stream_get_meta_data can be falsified by its 
+    input). (Leo Gaspard)
+  . Fixed bug #71459 (Integer overflow in iptcembed()). (Stas)
 
+- WDDX:
+  . Fixed bug #71335 (Type Confusion in WDDX Packet Deserialization). (Stas)
+  
+- Phar:
+  . Fixed bug #71354 (Heap corruption in tar/zip/phar parser). (Stas)
+  . Fixed bug #71391 (NULL Pointer Dereference in phar_tar_setupmetadata()).
+    (Stas)
+  . Fixed bug #71488 (Stack overflow when decompressing tar archives). (Stas)
 
 07 Jan 2015, PHP 5.5.31