diff -Nru tar-1.29b/debian/changelog tar-1.29b/debian/changelog
--- tar-1.29b/debian/changelog	2016-07-22 22:07:14.000000000 +0200
+++ tar-1.29b/debian/changelog	2016-10-30 07:35:31.000000000 +0100
@@ -1,3 +1,12 @@
+tar (1.29b-1.1) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * CVE-2016-6321: Bypassing the extract path name.
+    When extracting, member names containing '..' components are skipped.
+    (Closes: #842339)
+
+ -- Salvatore Bonaccorso <address@hidden>  Sun, 30 Oct 2016 07:35:31 +0100
+
 tar (1.29b-1) unstable; urgency=medium
 
   * re-constitute the 1.29 orig.tar with man pages as version 1.29b
diff -Nru tar-1.29b/debian/patches/When-extracting-skip-.-members.patch tar-1.29b/debian/patches/When-extracting-skip-.-members.patch
--- tar-1.29b/debian/patches/When-extracting-skip-.-members.patch	1970-01-01 01:00:00.000000000 +0100
+++ tar-1.29b/debian/patches/When-extracting-skip-.-members.patch	2016-10-30 07:35:31.000000000 +0100
@@ -0,0 +1,33 @@
+Description: When extracting, skip ".." members (CVE-2016-6321)
+Origin: upstream,  http://git.savannah.gnu.org/cgit/tar.git/commit/?id=7340f67b9860ea0531c1450e5aa261c50f67165d
+Bug-Debian: https://bugs.debian.org/842339
+Forwarded: not-needed.
+Author: Paul Eggert <address@hidden>
+Last-Update: 2016-10-30
+---
+ src/extract.c | 8 ++++++++
+ 2 files changed, 15 insertions(+), 1 deletion(-)
+
+--- a/src/extract.c
++++ b/src/extract.c
+@@ -1629,12 +1629,20 @@ extract_archive (void)
+ {
+   char typeflag;
+   tar_extractor_t fun;
++  bool skip_dotdot_name;
+ 
+   fatal_exit_hook = extract_finish;
+ 
+   set_next_block_after (current_header);
+ 
++  skip_dotdot_name = (!absolute_names_option
++		      && contains_dot_dot (current_stat_info.orig_file_name));
++  if (skip_dotdot_name)
++    ERROR ((0, 0, _("%s: Member name contains '..'"),
++	    quotearg_colon (current_stat_info.orig_file_name)));
++
+   if (!current_stat_info.file_name[0]
++      || skip_dotdot_name
+       || (interactive_option
+ 	  && !confirm ("extract", current_stat_info.file_name)))
+     {
diff -Nru tar-1.29b/debian/patches/series tar-1.29b/debian/patches/series
--- tar-1.29b/debian/patches/series	2016-07-22 22:07:14.000000000 +0200
+++ tar-1.29b/debian/patches/series	2016-10-30 07:35:31.000000000 +0100
@@ -1,3 +1,4 @@
 pristine-tar.diff
 listed03-linux-only
 rmt.8-header-wrong
+When-extracting-skip-.-members.patch