The Drupal project uses the third-party library [Archive\_Tar](https://pear.php.net/package/Archive_Tar/), which has released a security improvement that is needed to protect some Drupal configurations.
Multiple vulnerabilities are possible if Drupal is configured to allow `.tar`, `.tar.gz`, `.bz2` or `.tlz` file uploads and processes them.
The latest versions of Drupal update `Archive_Tar` to 1.4.9 to mitigate the file processing vulnerabilities.
*Edited to clarify the nature of the upstream release.*
