Update information on CVE-2019-11779

Directly reference the upstream issue and fixes in the 1.5.x and 1.6.x
branches.

According to Roger Light (upstream) this issue should affect versions
1.5 to 1.6.5 inclusive and was fixed in 1.6.6 and 1.5.9.