Ubuntu Security Notice 986-3 – USN-986-1 fixed vulnerabilities in bzip2. dpkg statically links against libbz2 and needed to be rebuilt to use the updated libbz2. An integer overflow was discovered in bzip2. If a user or automated system were tricked into decompressing a crafted bz2 file, an attacker could cause bzip2 or any application linked against libbz2 to crash or possibly execute code as the user running the program.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/94070/USN-986-3.txt
Source: https://packetstormsecurity.com/files/94070/Ubuntu-Security-Notice-986-3.html