Four more CVEs for exiv2 were affecting only experimental

More importantly those were then later on fixed in an upstream version
which then moved fixed directly to unstable without making unstable
vulnerable.

Note this appears not to be the case for every of the issues we ever
marked only affected in experimental, so some further extra care and
possibly the marking needs to be updated.