Latest lua lua Vulnerabilities

● CVE-2021-45985

In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read.

Lua Lua=5.4.3

● CVE-2022-33099

An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs.

Lua Lua>=5.4.2<=5.4.4

Fedoraproject Fedora=35

Fedoraproject Fedora=36

● CVE-2022-28805

Lua Lua>=5.4.0<=5.4.4

Fedoraproject Fedora=35

Fedoraproject Fedora=36

● CVE-2021-44964

Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a crafted script file.

Lua Lua>=5.4.0<=5.4.3

● CVE-2021-44647

Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.

Lua Lua=5.4.3

Fedoraproject Fedora=34

● CVE-2021-43519

Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file.

Lua Lua>=5.1.0<5.3.5

Lua Lua>=5.4.0<5.4.4

Fedoraproject Fedora=35

● CVE-2021-32918

An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service (DoS) attacks via memory exhaustion when running under Lua 5.2 or Lua 5.3...

debian/prosody

Prosody Prosody<0.11.9

Lua Lua=5.2.0

Lua Lua=5.3.0

Debian Debian Linux=10.0

Fedoraproject Fedora=32

and 2 more

● CVE-2021-32921

An issue was discovered in Prosody before 0.11.9. It does not use a constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or later. This can potentially be used in a ...

debian/prosody

Prosody Prosody<0.11.9

Lua Lua>=5.2.0

Fedoraproject Fedora=32

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 1 more

● CVE-2020-24371

lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.

Lua Lua=5.4.0

● CVE-2020-24369

ldebug.c in Lua 5.4.0 attempts to access debug information via the line hook of a stripped function, leading to a NULL pointer dereference.

Lua Lua=5.4.0

● CVE-2020-24370

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).

Lua Lua=5.4.0

Fedoraproject Fedora=31

Fedoraproject Fedora=32

Debian Debian Linux=9.0

IBM QRadar SIEM<=7.5.0 GA

IBM QRadar SIEM<=7.4.3 GA - 7.4.3 FP4

and 1 more

● CVE-2020-24342

Lua through 5.4.0 allows a stack redzone cross in luaO_pushvfstring because a protection mechanism wrongly calls luaD_callnoyield twice in a row.

Lua Lua=5.4.0

Fedoraproject Fedora=33

● CVE-2020-15945

Lua through 5.4.0 has a segmentation fault in changedline in ldebug.c (e.g., when called by luaG_traceexec) because it incorrectly expects that an oldpc value is always updated upon a return of the fl...

Lua Lua>=5.3.1<5.4.0

● CVE-2020-15889

Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members.

Lua Lua=5.4.0

● CVE-2019-6706

Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have c...

Lua Lua=5.3.5

Canonical Ubuntu Linux=16.04

Canonical Ubuntu Linux=18.04

Canonical Ubuntu Linux=18.10

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.