Issue separate CVEs for patched security issues

Issuing separte CVEs for the two fixes was recommended by Google's internal
process owner to follow standard CVE practices.

Change-Id: I8f2c8fc2aad9f62413f08d6de675c6954462201e
7 files changed