Ubuntu Security Notice 385-1 – Teemu Salmela discovered that tar still handled the deprecated GNUTYPE_NAMES record type. This record type could be used to create symlinks that would be followed while unpacking a tar archive. If a user or an automated system were tricked into unpacking a specially crafted tar file, arbitrary files could be overwritten with user privileges.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/52615/USN-385-1.txt
Source: https://packetstormsecurity.com/files/52615/Ubuntu-Security-Notice-385-1.html