Update CVE-2019-14868/ksh

Remove slightly confusing note, as the issue like other related issues
would allow to inject code. This is not to say the issue should not be
treaded as no-dsa (this still has to be evaluated).