Unintentional directory traversal by poisoned NUL byte in Dir

There is an unintentional directory traversal in some methods in Dir

Dir.open, Dir.new, Dir.entries and Dir.empty? accept the path of the
target directory as their parameter. If the parameter contains NUL (\0)
bytes, these methods recognize that the path is completed before the NUL bytes.
So, if a script accepts an external input as the argument of these methods, the
attacker can make the unintentional directory traversal.

All users running an affected release should upgrade immediately.