Add CVE-2019-12164 with NOTE

I think this is just a mistype of the CVE id and causing confusion.
There is already CVE-2019-13164 which refers to the same qemu post on
the mailinglist and furthermore has a oss-security reference.