Filled bug for CVE-2018-9145/exiv2 in experimental

The issue likely does not affect versions prior to 0.26 upstream before
https://github.com/Exiv2/exiv2/commit/163f3ce7f17a143f58d857a5cba3cb7b24436a2a
but more analysis is pending before moving to <not-affected> status.