CVE-2019-19391: Critical severity luajit vulnerability
DISPUTED In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue that leads to arbitrary memory write or read operations, because certain cases involving valid stack levels and > options are mishandled. NOTE: The LuaJIT project owner states that the debug libary is unsafe by definition and that this is not a vulnerability. When LuaJIT was originally developed, the expectation was that the entire debug library had no security guarantees and thus it made no sense to assign CVEs. However, not all users of later LuaJIT derivatives share this perspective.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-19391.
What is the severity of CVE-2019-19391?
The severity of CVE-2019-19391 is critical, with a severity value of 9.1.
Which software products are affected by CVE-2019-19391?
The software products affected by CVE-2019-19391 are LuaJIT versions up to and including 2.0.5 and Moonjit versions up to but excluding 2.1.2.
What is the CWE number associated with CVE-2019-19391?
The CWE number associated with CVE-2019-19391 is CWE-843.
Is there a patch or fix available for CVE-2019-19391?
At the time of writing, there is no information available about a patch or fix for CVE-2019-19391. It is recommended to monitor the official sources for updates.