Add CVE-2018-1587{8,9}/libgd2

They are related to the same upstream issue as CVE-2018-1000222 and it's
a bit unclear why two more CVEs were assigned. The assigning CNA is in
all three cases MITRE itself.

Opened a question to MITRE if they are duplicate or try to understand
the multiple assignments.