Security News

Cybersecurity news aggregator

🐧
MEDIUM Vulnerabilities Ubuntu Security

USN-8168-2: Rust vulnerability

  • What: A vulnerability in Rust's tar-rs library allows symlink manipulation.
  • Impact: Users processing malicious tar archives may face privilege escalation.
Read Full Article →

USN-8168-1 fixed a vulnerability in Rust. This update provides the corresponding update to Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that tar-rs embedded in rustc incorrectly handled symlinks when unpacking a tar archive. If a user or automated system were tricked into processing a specially crafted tar archive, a remote attacker could use this issue to modify permissions of arbitrary directories outside the extraction root, and possibly escalate privileges.

Share this article