* Support for zstd compression (if zstd is installed).
* The -K option interacts properly with member names given on the command line.
* Fix handling of file shrinkage during read access when --sparse is used.
* Member names containing '..' components are now skipped when extracting.
* Report erroneous use of position-sensitive options.
* --numeric-owner now affects private headers too.
* Fixed the --delay-directory-restore option
* The --warnings=failed-read option
* The --warnings=none option now suppresses all warnings
* Fix reporting of hardlink mismatches during compare
* New checkpoint action: totals
* Extended checkpoint format specification.
* New option --one-top-level
* New option --sort
* New exclusion options
* Manpages
* Fix unquoting of file names obtained via the -T option.
* Fix GNU long link header timestamp (backward compatibility).
* Fix extracting sparse members from star archives.
Heap-based buffer overflow allows remote rmt servers to cause a
denial of service (memory corruption) or possibly execute arbitrary
code by sending more data than was requested.
prodded by jasper@
* Fix archivation of sparse files in posix mode.
* Fix operation of --verify --listed-incremental.
* Fix --occurrence.
* Scope of --transform and --strip-components options.
* End-of-volume script can send the new volume name to tar.
* New option --exclude-tag allows to specify "exclusion tag files".
* The --exclude-cache option now excludes the directories themselves, too.
* Support for reading ustar type 'N' logical records has been removed.
* Race conditions around 'tar -x --same-owner' have been fixed.
GNU tar allows user-assisted attackers to overwrite arbitrary files
via a tar file that contains a GNUTYPE_NAMES record with a symbolic
link. (CVE-2006-6097)
A buffer overflow allows user-complicit attackers to cause a denial
of service (application crash) and possibly execute code via
unspecified vectors involving PAX extended headers.
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0300
Fix via Ubuntu (ultimately from upstream CVS).
ok pvalchev@