Gentoo Linux Security Advisory GLSA 200703-11 - The Magnatune downloader doesn't quote the m_currentAlbumFileName parameter while calling the unzip shell command. Versions less than 1.4.5-r1 are affected.
9921fd92676a28a15379fe15dd5356e711779256fd3a45ac192d249d6911eb50