CVE-2014-3227

dpkg 1.15.9, 1.16.x before 1.16.14, and 1.17.x before 1.17.9 expect the
patch program to be compliant with a need for the “C-style encoded
filenames” feature, but is supported in environments with noncompliant
patch programs, which triggers an interaction error that allows remote
attackers to conduct directory traversal attacks and modify files outside
of the intended directories via a crafted source package. NOTE: this
vulnerability exists because of reliance on unrealistic constraints on the
behavior of an external program.