doc: Add missing CVE links to advisories

Some security advisories did not contain a direct link to the CVE page
on mitre.org.

Change-Id: I80f8f27a25da3a76b564a3e49cafe5e253379f37
Signed-off-by: Paul Beesley <paul.beesley@arm.com>
diff --git a/docs/security_advisories/security-advisory-tfv-5.rst b/docs/security_advisories/security-advisory-tfv-5.rst
index 6525645..4479bf0 100644
--- a/docs/security_advisories/security-advisory-tfv-5.rst
+++ b/docs/security_advisories/security-advisory-tfv-5.rst
@@ -2,7 +2,7 @@
 | Title          | Not initializing or saving/restoring ``PMCR_EL0`` can leak  |
 |                | secure world timing information                             |
 +================+=============================================================+
-| CVE ID         | CVE-2017-15031                                              |
+| CVE ID         | `CVE-2017-15031`_                                           |
 +----------------+-------------------------------------------------------------+
 | Date           | 02 Oct 2017                                                 |
 +----------------+-------------------------------------------------------------+
@@ -39,4 +39,5 @@
 The same issue exists for the equivalent AArch32 register, ``PMCR``, except that
 here ``PMCR_EL0.DP`` architecturally resets to zero.
 
+.. _CVE-2017-15031: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15031
 .. _Pull Request #1127: https://github.com/ARM-software/arm-trusted-firmware/pull/1127