Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade lua-develUpgrade lua | May 4, 2022 | Jan 23, 2019 |
| Alpine Linux | — | Upgrade lua5.3Upgrade lua5.4 | May 7, 2019 | Jan 23, 2019 |
| Centos_linux | — | Upgrade luaUpgrade lua-libs-debuginfoUpgrade lua-libsUpgrade lua-debuginfoUpgrade lua-debugsource | Nov 6, 2019 | Jan 23, 2019 |
| Debian | — | Upgrade lua5.3 | Feb 14, 2019 | Feb 14, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade lua-libsUpgrade lua | Jul 26, 2019 | Jan 23, 2019 |
| Oracle Solaris | — | Upgrade editor/vim to version 8.2.444-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-tcl to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-python-37 to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade library/python/rrdtool-27 to version 1.7.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade editor/gvim to version 8.2.444-11.4.27.0.1.82.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-dbd to version 2.4.46-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-ruby to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl-fips-140 to version 2.4.46-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-php-71 to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-java to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-php to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-php-73 to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-perl to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-gss to version 2.4.46-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-python-27 to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade runtime/lua to version 5.4.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/rrdtool to version 1.7.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade library/lua/lgi-52 to version 0.9.2-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-php-74 to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade library/desktop/libpeas to version 1.24.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade editor/vim/vim-core to version 8.2.444-11.4.27.0.1.82.0 on Solaris 11.4Upgrade library/lua/lgi-54 to version 0.9.2-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-perl-522 to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/graphviz/graphviz-sharp to version 2.42.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade web/server/lighttpd-14 to version 1.4.54-11.4.27.0.1.82.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ldap to version 2.4.46-11.4.27.0.1.82.0 on Solaris 11.4Upgrade web/server/apache-24 to version 2.4.46-11.4.27.0.1.82.0 on Solaris 11.4Upgrade image/gnuplot to version 5.2.2-11.4.27.0.1.82.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl to version 2.4.46-11.4.27.0.1.82.0 on Solaris 11.4Upgrade library/python/rrdtool to version 1.7.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-security to version 2.9.2-11.4.27.0.1.82.0 on Solaris 11.4 | Jan 19, 2021 | Jan 23, 2019 |
| Oracle_linux | — | Upgrade lua-develUpgrade lua-libsUpgrade lua | Oct 5, 2022 | Jan 10, 2019 |
| Redhat_linux | — | Upgrade lua-debuginfoUpgrade luaUpgrade lua-libs-debuginfoUpgrade lua-debugsourceUpgrade lua-libsUpgrade lua-devel | Nov 6, 2019 | Jan 23, 2019 |
| Rocky_linux | — | Upgrade lua-debuginfoUpgrade lua-develUpgrade luaUpgrade lua-libsUpgrade lua-debugsourceUpgrade lua-libs-debuginfo | Mar 12, 2024 | Jan 23, 2019 |
| Suse | — | Upgrade lua53-develUpgrade liblua5_3-5-32bitUpgrade liblua5_3-5Upgrade lua53-docUpgrade lua53 | Feb 15, 2019 | Jan 23, 2019 |
| Ubuntu | — | Upgrade lua5.3 | Apr 16, 2019 | Jan 23, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 23, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub