Add upstream references for CVE-2019-624{5,6,7}