[PATCH] Record CVE-2018-6485 in ChangeLog and NEWS [BZ #22343]

[Florian Weimer]

I got another CVE assignment from MITRE for the posix_memalign issue. 
Can we still install it?

Arjun is looking into the malloc fix; we have some disagreement there to 
what extent it is a separate issue.  I do not observe it with our 
2.17-based build on i386.  If the affected version range is different 
from the posix_memalign issue, technically, we should assign a separate 
CVE ID (but it doesn't make sense to stop the release for that).

Thanks,
Florian