runzip: mark package as insecure

The package vendorized a (customized) old libzip version. Since the
library was customized, it's not easy to unvendorize it. We should
probably assume that CVEs that affected the old libzip version still
affect the package.

pkgs/by-name/ru/runzip/package.nix

@@ -39,6 +39,11 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Tool to convert filename encoding inside a ZIP archive";
     license = lib.licenses.bsd2;
     maintainers = [ lib.maintainers.raskin ];
+    # runzip vendors libzip 0.7.1.
+    knownVulnerabilities = [
+      "CVE-2015-2331"
+      "CVE-2017-14107"
+    ];
     platforms = lib.platforms.unix;
     mainProgram = "runzip";
   };