Add reference for CVE-2018-19760/confuse

The original reporter did wrongly report the issue to the Red Hat
Bugzilla and was asked to actually report it first upstream. Needs check
if that has happened.