Name: CVE-2020-15889: Out-of-bounds Read
Creator: Rapid7
Published: 2020-07-21T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2020-15889, CWE-125, CVSS 9.8, EPSS 0.0051

Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members.

CVSS Details

CVSS 3.1 Base Score: 9.8
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Arch Linux	—	Upgrade to the latest version of Arch Linux	Jul 11, 2025	Jul 21, 2020
Debian	—	Upgrade lua5.4	Jul 30, 2024	Jul 21, 2020
Oracle Solaris	—	Upgrade web/server/apache-24/module/apache-security to version 2.9.2-11.4.27.0.1.82.0 on Solaris 11.4Upgrade library/python/rrdtool to version 1.7.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade web/server/apache-24 to version 2.4.46-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-perl-522 to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/gnuplot to version 5.2.2-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade editor/vim/vim-core to version 8.2.444-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-php-71 to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade library/desktop/libpeas to version 1.24.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-sharp to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-python-27 to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ldap to version 2.4.46-11.4.27.0.1.82.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl to version 2.4.46-11.4.27.0.1.82.0 on Solaris 11.4Upgrade web/server/lighttpd-14 to version 1.4.54-11.4.27.0.1.82.0 on Solaris 11.4Upgrade runtime/lua to version 5.4.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-dbd to version 2.4.46-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-java to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-gss to version 2.4.46-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-perl to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade library/python/rrdtool-27 to version 1.7.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-php-73 to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/rrdtool to version 1.7.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade library/lua/lgi-52 to version 0.9.2-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-php to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade editor/vim to version 8.2.444-11.4.27.0.1.82.0 on Solaris 11.4Upgrade library/lua/lgi-54 to version 0.9.2-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-python-37 to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-tcl to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-php-74 to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-ruby to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade editor/gvim to version 8.2.444-11.4.27.0.1.82.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl-fips-140 to version 2.4.46-11.4.27.0.1.82.0 on Solaris 11.4	Jan 19, 2021	Jul 21, 2020

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business