Clarify status for CVE-2018-9251/libxml2

Add CVE-2017-18258 at the same time. The situation has been clarified.
So CVE-2018-9251 is only an issue if upstream commit
https://git.gnome.org/browse/libxml2/commit/?id=e2a9122b8dde53d320750451e9907a7dcb2ca8bb
is applied (which was assigned CVE-2017-18258).