Bug#306693: cpio: allows extracting insecure pathnames (leading slash = / and dotdot = ..)

[t takahashi]

Tags: security
Severity: grave