PT-2019-5458 · Lua+9 · Lua+9
Fady Osman
·
Publicado
2019-01-10
·
Atualizado
2026-05-26
·
CVE-2019-6706
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Lua version 5.3.5
Description
The issue is related to a use-after-free in the
lua upvaluejoin function in lapi.c, which can be exploited by an attacker to cause a crash. This can be achieved by triggering a debug.upvaluejoin call with specific argument relationships. The vulnerability may allow a remote attacker to cause a denial of service.Recommendations
For Lua version 5.3.5, as a temporary workaround, consider disabling the
lua upvaluejoin function in lapi.c until a patch is available. Restrict access to the debug.upvaluejoin call to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
DoS
Use After Free
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Astra Linux
Centos
Lua
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu