Add NEWS entry for CVE-2016-10228 (bug 19519)