Replace source-package name for CVE-2019-2212

Assuming the 7.0 was a typo, as there is no such source package, but
instead reference llvm-toolchain-8. No further checking on the affected
source has been done though.