lua lua vulnerabilities and exploits

(subscribe to this query)

NA

Buffer overflow in the vararg functions in ldo.c in Lua 5.1 up to and including 5.2.x prior to 5.2.3 allows context-dependent malicious users to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.

Opensuse Opensuse 12.3 Opensuse Opensuse 13.1 Canonical Ubuntu Linux 12.04 Canonical Ubuntu Linux 14.04 Debian Debian Linux 7.0 Lua Lua 5.1.3 Lua Lua 5.1.4 Lua Lua 5.1.2 Lua Lua 5.1.5 Lua Lua 5.1.1 Lua Lua 5.1 Lua Lua 5.2.1 Lua Lua 5.2.0 Lua Lua 5.2.2 Mageia Mageia 3.0 Mageia Mageia 4.0

1 Github repository

6.3

CVSSv3

Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows malicious users to perform Sandbox Escape via a crafted script file.

Lua Lua

5.5

CVSSv3

Lua up to and including 5.4.0 has a segmentation fault in changedline in ldebug.c (e.g., when called by luaG_traceexec) because it incorrectly expects that an oldpc value is always updated upon a return of the flow of control to a function.

Lua Lua

8.8

CVSSv3

Lua up to and including 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free.

Lua Lua 5.4.0

9.8

CVSSv3

Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members.

Lua Lua 5.4.0

7.5

CVSSv3

ldebug.c in Lua 5.4.0 attempts to access debug information via the line hook of a stripped function, leading to a NULL pointer dereference.

Lua Lua 5.4.0

5.3

CVSSv3

lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.

Lua Lua 5.4.0

7.5

CVSSv3

In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read.

Lua Lua 5.4.3

5.5

CVSSv3

Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows malicious users to perform a Denial of Service via a crafted script file.

Lua Lua Fedoraproject Fedora 35

5.5

CVSSv3

Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.

Lua Lua 5.4.3 Fedoraproject Fedora 34

Get Started

1 2 3 4 5 6 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook