{"id":"USN-8168-2","summary":"rustc, rustc-1.76, rustc-1.77, rustc-1.78, rustc-1.79, rustc-1.80\nvulnerability","details":"USN-8168-1 fixed a vulnerability in Rust. This update provides the\ncorresponding update to Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04\nLTS and Ubuntu 20.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that tar-rs embedded in rustc incorrectly handled\n symlinks when unpacking a tar archive. If a user or automated system were\n tricked into processing a specially crafted tar archive, a remote attacker\n could use this issue to modify permissions of arbitrary directories\n outside the extraction root, and possibly escalate privileges.","modified":"2026-06-29T13:51:18.886908178Z","published":"2026-04-14T18:01:04Z","upstream":["UBUNTU-CVE-2026-33056"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8168-2"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-33056"}],"affected":[{"package":{"name":"rustc","ecosystem":"Ubuntu:Pro:14.04:LTS","purl":"pkg:deb/ubuntu/rustc?arch=source&distro=trusty%2Fesm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0+dfsg1+llvm-2ubuntu1~14.04.1ubuntu1"}]}],"versions":["1.15.1+dfsg0-1~exp1ubuntu2~14.04.7","1.17.0+dfsg2-8~ubuntu0.14.04.3","1.21.0+dfsg1+llvm-0ubuntu3~14.04.5","1.22.1+dfsg1+llvm-0ubuntu2~14.04.2","1.24.1+dfsg1+llvm-0ubuntu1~14.04.1","1.25.0+dfsg1+llvm-0ubuntu1~14.04.1","1.28.0+dfsg1+llvm-0ubuntu1~14.04.1","1.30.0+dfsg1+llvm-2ubuntu1~14.04.1","1.31.0+dfsg1+llvm-2ubuntu1~14.04.1"],"ecosystem_specific":{"binaries":[{"binary_name":"libstd-rust-1.31","binary_version":"1.31.0+dfsg1+llvm-2ubuntu1~14.04.1ubuntu1"},{"binary_version":"1.31.0+dfsg1+llvm-2ubuntu1~14.04.1ubuntu1","binary_name":"rust-gdb"},{"binary_name":"rust-lldb","binary_version":"1.31.0+dfsg1+llvm-2ubuntu1~14.04.1ubuntu1"},{"binary_name":"rust-src","binary_version":"1.31.0+dfsg1+llvm-2ubuntu1~14.04.1ubuntu1"},{"binary_name":"rustc","binary_version":"1.31.0+dfsg1+llvm-2ubuntu1~14.04.1ubuntu1"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8168-2.json","cves_map":{"cves":[],"ecosystem":"Ubuntu:Pro:14.04:LTS"}}},{"package":{"name":"rustc","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/rustc?arch=source&distro=esm-infra%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.47.0+dfsg1+llvm-1ubuntu1~16.04.1ubuntu2"}]}],"versions":["1.7.0+dfsg1-1","1.15.1+dfsg0-1~exp1ubuntu2~16.04.3","1.17.0+dfsg2-8~ubuntu0.16.04.2","1.21.0+dfsg1+llvm-0ubuntu3~16.04.1","1.22.1+dfsg1+llvm-0ubuntu2~16.04.2","1.24.1+dfsg1+llvm-0ubuntu1~16.04.1","1.25.0+dfsg1+llvm-0ubuntu1~16.04.1","1.28.0+dfsg1+llvm-0ubuntu1~16.04.1","1.30.0+dfsg1+llvm-2ubuntu1~16.04.1","1.31.0+dfsg1+llvm-2ubuntu1~16.04.1","1.32.0+dfsg1+llvm-1ubuntu1~16.04.1","1.34.1+dfsg2+llvm-0ubuntu1~16.04.1","1.35.0+dfsg0.1+llvm-0ubuntu1~16.04.1","1.36.0+dfsg1+llvm-2ubuntu1~16.04.1","1.37.0+dfsg1+llvm-1ubuntu1~16.04.1","1.39.0+dfsg1+llvm-3ubuntu1~16.04.1","1.41.0+dfsg1+llvm-0ubuntu1~16.04.1","1.43.0+dfsg1+llvm-1~exp1ubuntu2~16.04.1","1.47.0+dfsg1+llvm-1ubuntu1~16.04.1"],"ecosystem_specific":{"binaries":[{"binary_name":"libstd-rust-1.47","binary_version":"1.47.0+dfsg1+llvm-1ubuntu1~16.04.1ubuntu2"},{"binary_version":"1.47.0+dfsg1+llvm-1ubuntu1~16.04.1ubuntu2","binary_name":"rust-gdb"},{"binary_name":"rust-lldb","binary_version":"1.47.0+dfsg1+llvm-1ubuntu1~16.04.1ubuntu2"},{"binary_name":"rust-src","binary_version":"1.47.0+dfsg1+llvm-1ubuntu1~16.04.1ubuntu2"},{"binary_name":"rustc","binary_version":"1.47.0+dfsg1+llvm-1ubuntu1~16.04.1ubuntu2"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:Pro:16.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8168-2.json"}},{"package":{"name":"rustc","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/rustc?arch=source&distro=esm-infra%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.18.04.1"}]}],"versions":["1.18.0+dfsg1-4ubuntu1","1.24.1+dfsg1+llvm-0ubuntu1","1.24.1+dfsg1+llvm-0ubuntu2","1.25.0+dfsg1+llvm-0ubuntu1","1.28.0+dfsg1+llvm-0ubuntu1~18.04.1","1.30.0+dfsg1+llvm-2ubuntu1~18.04.1","1.31.0+dfsg1+llvm-2ubuntu1~18.04.1","1.32.0+dfsg1+llvm-1ubuntu1~18.04.1","1.34.1+dfsg2+llvm-0ubuntu1~18.04.1","1.35.0+dfsg0.1+llvm-0ubuntu1~18.04.1","1.36.0+dfsg1+llvm-2ubuntu1~18.04.1","1.37.0+dfsg1+llvm-1ubuntu1~18.04.1","1.39.0+dfsg1+llvm-3ubuntu1~18.04.1","1.41.0+dfsg1+llvm-0ubuntu1~18.04.1","1.43.0+dfsg1+llvm-1~exp1ubuntu2~18.04.1","1.47.0+dfsg1+llvm-1ubuntu1~18.04.1","1.51.0+dfsg1+llvm-1~exp3ubuntu1~18.04.1","1.53.0+dfsg1+llvm-4ubuntu1~18.04.1","1.57.0+dfsg1+llvm-0ubuntu1~18.04.1","1.59.0+dfsg1~ubuntu1~llvm-1~ubuntu1~18.04.2","1.61.0+dfsg1~llvm-1~exp1ubuntu0.18.04.1","1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.18.04"],"ecosystem_specific":{"binaries":[{"binary_name":"libstd-rust-1.65","binary_version":"1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.18.04.1"},{"binary_name":"rust-all","binary_version":"1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.18.04.1"},{"binary_version":"1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.18.04.1","binary_name":"rust-clippy"},{"binary_name":"rust-gdb","binary_version":"1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.18.04.1"},{"binary_name":"rust-lldb","binary_version":"1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.18.04.1"},{"binary_name":"rust-src","binary_version":"1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.18.04.1"},{"binary_name":"rustc","binary_version":"1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.18.04.1"},{"binary_name":"rustfmt","binary_version":"1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.18.04.1"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:18.04:LTS","cves":[]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8168-2.json"}},{"package":{"name":"rustc","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/rustc?arch=source&distro=esm-infra%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"}]}],"versions":["1.37.0+dfsg1+llvm-1ubuntu1","1.38.0+dfsg0.2+llvm-0ubuntu1","1.38.0+dfsg0.2+llvm-0ubuntu2","1.39.0+dfsg1+llvm-3ubuntu1","1.40.0+dfsg1+llvm-5ubuntu1","1.41.0+dfsg1+llvm-0ubuntu1","1.41.0+dfsg1+llvm-0ubuntu2","1.43.0+dfsg1+llvm-1~exp1ubuntu1~20.04.1","1.47.0+dfsg1+llvm-1ubuntu1~20.04.1","1.51.0+dfsg1+llvm-1~exp3ubuntu1~20.04.2","1.53.0+dfsg1+llvm-4ubuntu1~20.04.1","1.57.0+dfsg1+llvm-0ubuntu1~20.04.1","1.59.0+dfsg1~ubuntu1~llvm-1~ubuntu1~20.04.2","1.61.0+dfsg1~llvm-1~exp1ubuntu0.20.04.1","1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.20.04","1.66.1+dfsg0ubuntu1~llvm-0ubuntu0.20.04","1.70.0+dfsg0ubuntu1~bpo2-0ubuntu0.20.04","1.70.0+dfsg0ubuntu1~bpo2-0ubuntu0.20.04.1","1.71.1+dfsg0ubuntu3~bpo0-0ubuntu0.20.04","1.72.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04","1.73.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1","1.74.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1","1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04"],"ecosystem_specific":{"binaries":[{"binary_name":"cargo","binary_version":"1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_version":"1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1","binary_name":"libstd-rust-1.75"},{"binary_name":"rust-all","binary_version":"1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_name":"rust-clippy","binary_version":"1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_name":"rust-gdb","binary_version":"1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_name":"rust-lldb","binary_version":"1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_name":"rust-src","binary_version":"1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_version":"1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1","binary_name":"rustc"},{"binary_version":"1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1","binary_name":"rustfmt"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:20.04:LTS","cves":[]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8168-2.json"}},{"package":{"name":"rustc-1.76","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/rustc-1.76?arch=source&distro=esm-infra%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"}]}],"versions":["1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro","binaries":[{"binary_version":"1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1","binary_name":"cargo-1.76"},{"binary_name":"libstd-rust-1.76","binary_version":"1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_name":"rust-1.76-all","binary_version":"1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_name":"rust-1.76-clippy","binary_version":"1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_name":"rust-1.76-gdb","binary_version":"1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_name":"rust-1.76-lldb","binary_version":"1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_name":"rust-1.76-src","binary_version":"1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_version":"1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1","binary_name":"rustc-1.76"},{"binary_version":"1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1","binary_name":"rustfmt-1.76"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8168-2.json","cves_map":{"ecosystem":"Ubuntu:Pro:20.04:LTS","cves":[]}}},{"package":{"name":"rustc-1.77","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/rustc-1.77?arch=source&distro=esm-infra%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"}]}],"versions":["1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.20.04"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro","binaries":[{"binary_name":"cargo-1.77","binary_version":"1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_version":"1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1","binary_name":"libstd-rust-1.77"},{"binary_name":"rust-1.77-all","binary_version":"1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_name":"rust-1.77-clippy","binary_version":"1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_name":"rust-1.77-gdb","binary_version":"1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_version":"1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1","binary_name":"rust-1.77-lldb"},{"binary_name":"rust-1.77-src","binary_version":"1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_name":"rustc-1.77","binary_version":"1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_name":"rustfmt-1.77","binary_version":"1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"}]},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:Pro:20.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8168-2.json"}},{"package":{"name":"rustc-1.78","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/rustc-1.78?arch=source&distro=esm-infra%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"}]}],"versions":["1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro","binaries":[{"binary_version":"1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1","binary_name":"cargo-1.78"},{"binary_name":"libstd-rust-1.78","binary_version":"1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_name":"rust-1.78-all","binary_version":"1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_version":"1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1","binary_name":"rust-1.78-clippy"},{"binary_name":"rust-1.78-gdb","binary_version":"1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_name":"rust-1.78-lldb","binary_version":"1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_name":"rust-1.78-src","binary_version":"1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_name":"rustc-1.78","binary_version":"1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_version":"1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1","binary_name":"rustfmt-1.78"}]},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:Pro:20.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8168-2.json"}},{"package":{"name":"rustc-1.79","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/rustc-1.79?arch=source&distro=esm-infra%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.3"}]}],"versions":["1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.3","binary_name":"cargo-1.79"},{"binary_version":"1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.3","binary_name":"libstd-rust-1.79"},{"binary_name":"rust-1.79-all","binary_version":"1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.3"},{"binary_name":"rust-1.79-clippy","binary_version":"1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.3"},{"binary_name":"rust-1.79-gdb","binary_version":"1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.3"},{"binary_name":"rust-1.79-lldb","binary_version":"1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.3"},{"binary_name":"rust-1.79-src","binary_version":"1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.3"},{"binary_version":"1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.3","binary_name":"rustc-1.79"},{"binary_name":"rustfmt-1.79","binary_version":"1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.3"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:20.04:LTS","cves":[]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8168-2.json"}},{"package":{"name":"rustc-1.80","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/rustc-1.80?arch=source&distro=esm-infra%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"}]}],"versions":["1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro","binaries":[{"binary_version":"1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1","binary_name":"cargo-1.80"},{"binary_version":"1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1","binary_name":"libstd-rust-1.80"},{"binary_name":"rust-1.80-all","binary_version":"1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_name":"rust-1.80-clippy","binary_version":"1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_name":"rust-1.80-gdb","binary_version":"1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_version":"1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1","binary_name":"rust-1.80-lldb"},{"binary_name":"rust-1.80-src","binary_version":"1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_name":"rustc-1.80","binary_version":"1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"},{"binary_name":"rustfmt-1.80","binary_version":"1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:20.04:LTS","cves":[]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8168-2.json"}}],"schema_version":"1.7.5"}