Update entry for CVE-2015-1418, keep TODO until clarified with MITRE

Same issue is in src:patch as well as shown by
https://bugs.debian.org/894993 and
https://rachelbythebay.com/w/2018/04/05/bangpatch/ with a crafted patch
file.

For now associate CVE-2015-1418 as well with src:patch but clarfication
with MITRE is pending if the src:patch issue should get a new
identifier bsdpatch and GNU patch being different sources.