Add xorg reference for CVE-2018-20839

It is not fully clarified yet, but systemd upstream claims this is not a
problem in systemd and defers it to xorg. There is now an upstream issue
opened at https://gitlab.freedesktop.org/xorg/xserver/issues/857 .