Add CVE id to 1.5.4 NEWS.

--

Note that the 1.6 branch and later versions were not vulnerable
because they already used the sliding window method.