Add CVEs associated with LibreDWG (old itp'ed package)

Although the ITP has been closed track for consistency under the
original ITP for the unlikely event that there will be a respin of the
ITP.