zip: command injection vulnerability

see https://sintonen.fi/advisories/infozip-test-option-command-injection.txt debian has the patch, maybe we should apply it too