CVE-2022-33099: Buffer Overflow
An issue in the component luaGrunerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/lua5.1to a version that resolves this vulnerability.Fixed in 5.1.5-9Fixed in 5.1.5-11Fixed in 5.1.5-12 - Upgrade
Upgrade
debian/lua5.2to a version that resolves this vulnerability.Fixed in 5.2.4-3Fixed in 5.2.4-4 - Upgrade
Upgrade
debian/lua5.3to a version that resolves this vulnerability.Fixed in 5.3.6-2Fixed in 5.3.6-5 - Upgrade
Upgrade
debian/lua5.4to a version that resolves this vulnerability.Fixed in 5.4.4-3+deb12u1Fixed in 5.4.7-1Fixed in 5.4.9-1Fixed in 5.4.9-2 - Upgrade
Upgrade
debian/lua5.4to a version that resolves this vulnerability.Fixed in 5.4.4-3
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2022-33099.
What is the severity level of CVE-2022-33099?
The severity level of CVE-2022-33099 is high, with a CVSS score of 7.5.
Which software versions are affected by CVE-2022-33099?
CVE-2022-33099 affects Lua v5.4.4 and below.
How does CVE-2022-33099 impact the affected software?
CVE-2022-33099 leads to a heap-buffer overflow when a recursive error occurs.
Are there any references related to CVE-2022-33099?
Yes, you can find references related to CVE-2022-33099 at the following links: [link1](https://github.com/lua/lua/commit/42d40581dd919fb134c07027ca1ce0844c670daf), [link2](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJNJ66IFDUKWJJZXHGOLRGIA3HWWC36R/), [link3](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UHYZOEFDVLVAD6EEP4CDW6DNONIVVHPA/)