I thought about it a little bit more and I prefer adding breaks against the old version of libiso9660, instead of libdevice-cdio-perl. I think it makes more sense, because even though libdevice-cdio-perl is the only package, in Debian, that is affected by the issue, other software (that are not Debian packages) could see similar segfaults (as demonstrated by the minimal reproducer).
I just pushed a new version to unstable.
