add cve id for 2.8 release notes wrt #1737 fix

Author: cowtowncoder

release-notes/VERSION

@@ -91,7 +91,7 @@ Project: jackson-databind
 #1711: Delegating creator fails to work for binary data (`byte[]`) with
  binary formats (CBOR, Smile)
 #1735: Missing type checks when using polymorphic type ids
-#1737: Block more JDK types from polymorphic deserialization
+#1737: Block more JDK types from polymorphic deserialization (CVE 2017-15095)
 
 2.8.9 (12-Jun-2017)