Heap-based overflow vulnerability in lua5.2
Summary
DSA-3016-1: lua5.2 - security update. Affects lua5.2 versions < 5.2.1-3+deb7u1. Fixed in 5.2.1-3+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Lua is a simple, extensible, and embeddable programming language. It is widely used for scripting, game development, and other applications. The lua5.2 package is a specific version of Lua that is vulnerable to a heap-based overflow vulnerability.
Vulnerability Detail
The vulnerability in lua5.2 arises from the way it handles varargs functions with many fixed parameters called with few arguments. This can lead to application crashes or potentially allow arbitrary code execution. The issue has been assigned the CVE identifier CVE-2014-5461.
How To Fix
Minimum fixed version
5.2.1-3+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade lua5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The lua5.2 package is vulnerable to a heap-based overflow vulnerability. To mitigate this issue, it is important to upgrade to the fixed version of the package. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for lua5.2 →
FAQ
Lua is a lightweight and powerful scripting language used in various applications and industries.
A heap-based overflow vulnerability occurs when a program writes data beyond the allocated memory on the heap, potentially leading to crashes or code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, a fix is available for this vulnerability. It is recommended to upgrade the lua5.2 package to version 5.2.1-3+deb7u1 or later.
You can find more information about this vulnerability in the Debian Security Advisory DSA-3016-1.
Related vulnerabilities
Recent vulnerabilities recorded for lua5.2.
