CVE-2017-1000159 also affects atril

Checked that stretch is affected and the current version in buster
is fixed. It's probably been fixed earlier in buster, but I didn't
bother finding the exact one.