Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()

...