Update CVE-2017-7516, associate source package name

The original proposed fix in
https://lists.gnu.org/archive/html/bug-cpio/2017-06/msg00001.html was
not the way to go, resulting in attempt 2 in
https://lists.gnu.org/archive/html/bug-cpio/2017-06/msg00005.html