Vulnerability in lua5.3 - Security Update
Summary
DLA-3469-1: lua5.3 - security update. Affects lua5.3 versions < 5.3.3-1.1+deb10u1. Fixed in 5.3.3-1.1+deb10u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lua5.3 is a powerful, light-weight programming language designed for extending applications. It is vulnerable to two security issues that may result in denial of service or potential arbitrary code execution. The vulnerabilities are identified as CVE-2019-6706 and CVE-2020-24370.
Vulnerability Detail
The first vulnerability, CVE-2019-6706, is a heap-user-after-free vulnerability in lua_upvaluejoin() in lapi.c. This vulnerability can be triggered by calling debug.upvaluejoin() with specific arguments, potentially leading to denial of service or arbitrary code execution.
The second vulnerability, CVE-2020-24370, is a negation overflow and segmentation fault issue in getlocal() and setlocal(). It can be demonstrated by calling getlocal(3,2^31), resulting in a segmentation fault.
How To Fix
Minimum fixed version
5.3.3-1.1+deb10u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade lua5.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities.
Conclusion
lua5.3 is vulnerable to two security issues, CVE-2019-6706 and CVE-2020-24370, which can result in denial of service or potential arbitrary code execution. It is recommended to upgrade to version 5.3.3-1.1+deb10u1 or later to fix these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lua5.3 →
FAQ
lua5.3 is a powerful, light-weight programming language designed for extending applications.
CVE-2019-6706 is a heap-user-after-free vulnerability in lua_upvaluejoin() in lapi.c that can result in denial of service or arbitrary code execution.
CVE-2020-24370 is a negation overflow and segmentation fault issue in getlocal() and setlocal() that can cause a segmentation fault.
To fix these vulnerabilities, upgrade your lua5.3 packages to version 5.3.3-1.1+deb10u1 or later.
No, there are no known workarounds for these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for lua5.3.
