these will be part of 5.6.17 not 5.6.18

diff --git a/NEWS b/NEWS
index f85ab8edeefc8b606820b3a0bc1bac1606ffee02..dca8c3b93974551afbfe70700445fa4b660bbae4 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -7,17 +7,10 @@ PHP                                                                        NEWS
   . Fixed bug #71089 (No check to duplicate zend_extension). (Remi)
   . Added support for new HTTP 451 code. (Julien)
 
-- FPM:
-  . Fixed bug #70755 (fpm_log.c memory leak and buffer overflow). (Stas)
-
 - FTP:
   . Implemented FR #55651 (Option to ignore the returned FTP PASV address).
     (abrender at elitehosts dot com)
 
-- GD:
-  . Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array Index
-    Out of Bounds). (emmanuel dot law at gmail dot com).
-
 - Opcache:
   . Fixed bug #71127 (Define in auto_prepend_file is overwrite). (Laruence)
   . Fixed bug #71024 (Unable to use PHP 7.0 x64 side-by-side with PHP 5.6 x32
@@ -33,16 +26,6 @@ PHP                                                                        NEWS
 - Standard:
   . Fixed bug #70720 (strip_tags improper php code parsing). (Julien)
 
-- WDDX:
-  . Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization).
-    (taoguangchen at icloud dot com)
-  . Fixed bug #70741 (Session WDDX Packet Deserialization Type Confusion
-    Vulnerability). (taoguangchen at icloud dot com)
-
-- XMLRPC:
-  . Fixed bug #70728 (Type Confusion Vulnerability in PHP_to_XMLRPC_worker()).
-    (Julien)
-    
 17 Dec 2015, PHP 5.6.17
 
 - Core:
@@ -56,6 +39,13 @@ PHP                                                                        NEWS
   . Fixed bug #61751 (SAPI build problem on AIX: Undefined symbol:
     php_register_internal_extensions). (Lior Kaplan)
 
+- FPM:
+  . Fixed bug #70755 (fpm_log.c memory leak and buffer overflow). (Stas)
+
+- GD:
+  . Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array Index
+    Out of Bounds). (emmanuel dot law at gmail dot com).
+
 - Mysqlnd:
   . Fixed bug #68077 (LOAD DATA LOCAL INFILE / open_basedir restriction).
     (Laruence)
@@ -70,6 +60,16 @@ PHP                                                                        NEWS
 - PDO_Firebird:
   . Fixed bug #60052 (Integer returned as a 64bit integer on X64_86). (Mariuz)
 
+- WDDX:
+  . Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization).
+    (taoguangchen at icloud dot com)
+  . Fixed bug #70741 (Session WDDX Packet Deserialization Type Confusion
+    Vulnerability). (taoguangchen at icloud dot com)
+
+- XMLRPC:
+  . Fixed bug #70728 (Type Confusion Vulnerability in PHP_to_XMLRPC_worker()).
+    (Julien)
+
 26 Nov 2015, PHP 5.6.16
 
 - Core: