PT-2019-15837 · Luajit+3 · Luajit+3
CVSS v3.1
9.1
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
LuaJIT versions 2.0.5 and earlier
Moonjit versions prior to 2.1.2
Description
The issue involves a type confusion problem in the
debug.getinfo function, which can lead to arbitrary memory write or read operations due to mishandling of certain cases involving valid stack levels and options. The LuaJIT project owner considers the debug library unsafe by definition, but some users of later LuaJIT derivatives may have different expectations regarding its security.Recommendations
For LuaJIT versions 2.0.5 and earlier, consider disabling the
debug.getinfo function as a temporary workaround until further guidance is available.
For Moonjit versions prior to 2.1.2, update to version 2.1.2 or later to address the issue.
At the moment, there is no information about a newer version of LuaJIT that contains a fix for this issue.Correção
Type Confusion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Debian
Luajit
Moonjit