[USN-8139-1] cargo-c vulnerability

==========================================================================
Ubuntu Security Notice USN-8139-1
April 01, 2026

rust-cargo-c vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.10

Summary:

cargo-c could be made to modify permissions on arbitrary directories.

Software Description:
- rust-cargo-c: Helper program to build and install c-like libraries

Details:

It was discovered that tar-rs embedded in cargo-c incorrectly handled
symlinks when unpacking a tar archive. If a user or automated system were
tricked into processing a specially crafted tar archive, a remote attacker
could use this issue to modify permissions of arbitrary directories outside
the extraction root, and possibly escalate privileges.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
cargo-c 0.10.11-1ubuntu1.1
librust-cargo-c-dev 0.10.11-1ubuntu1.1

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-8139-1
CVE-2026-33056

Package Information:
https://launchpad.net/ubuntu/+source/rust-cargo-c/0.10.11-1ubuntu1.1