During transfer of bzip2 compressed filelist decompressed list size is not controlled leading to possibility of resource exhaustion.
vulners.com/securityvulns/securityvulns:doc:9669