Posted by Laël Cellier on Mar 20

Oh………………………… Big mistake. I might advertised too soon.

I saw changes were pushed in master, so I thought the next version
(which was 2.7.1) would be the one which will include the fix.
But as pointed out on
https://security-tracker.debian.org/tracker/CVE-2016-2324 no versions
including the fixes were released yet, and even 2.7.3 still include
path_name(). I didn’t checked the code (Sorrrry).

So the only way to fix it…