[ci skip] Update NEWS

diff --git a/NEWS b/NEWS
index 593cdc0701f6fa29886d90e86ce712880ecffe7e..505451e4706fedd94f21f4697378cea91082d59e 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -9,16 +9,16 @@ PHP                                                                        NEWS
   . Fixed bug #79535 (PHP crashes with specific opcache.optimization_level).
     (Nikita)
 
-- SimpleXML:
-  . Fixed bug #79528 (Different object of the same xml between 7.4.5 and
-    7.4.4). (cmb)
-
 - Standard:
   . Fixed bug #79561 (dns_get_record() fails with DNS_ALL). (cmb)
 
-30 Apr 2020, PHP 7.3.18RC1
+14 May 2020, PHP 7.3.18
 
 - Core:
+  . Fixed bug #78875 (Long filenames cause OOM and temp files are not cleaned). 
+    (CVE-2019-11048) (cmb)
+  . Fixed bug #78876 (Long variables in multipart/form-data cause OOM and temp 
+    files are not cleaned). (CVE-2019-11048) (cmb)
   . Fixed bug #79434 (PHP 7.3 and PHP-7.4 crash with NULL-pointer dereference
     on !CS constant). (Nikita)
   . Fixed bug #79477 (casting object into array creates references). (Nikita)
@@ -45,6 +45,10 @@ PHP                                                                        NEWS
 - Phar:
   . Fix bug #79503 (Memory leak on duplicate metadata). (cmb)
 
+- SimpleXML:
+  . Fixed bug #79528 (Different object of the same xml between 7.4.5 and
+    7.4.4). (cmb)
+
 - Standard:
   . Fixed bug #79468 (SIGSEGV when closing stream handle with a stream filter
     appended). (dinosaur)