CVE-2017-8283 in dpkg
Summary
dpkg-source in dpkg through 1.8.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which allows remote attackers to conduct directory traversal attacks via a crafted Debian source package, as demonstrated by use of dpkg-source on NetBSD.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.