There is an updated pull request by travankor against master on the void-packages repository

https://github.com/travankor/void-packages unzip
https://github.com/void-linux/void-packages/pull/17796

unzip: fix CVE-2018-18384.
Add bsdunzip as a alternative to unzip.

A patch file from https://github.com/void-linux/void-packages/pull/17796.patch is attached