Add upstream claimed (and checked for the respective commit) fixed version for CVE-2018-6954

"claimed" since there was a followup to the upstream issue at
https://github.com/systemd/systemd/issues/7986#issuecomment-371315606
claiming the issue is not entirely fixed.

Might need an incomplete-fix CVE.