PT-2014-1807 · Lua+2 · Lua+2

Murray Mcallister · Published 2014-08-21 · Updated 2025-07-03 · CVE-2014-5461

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Lua versions 5.1 through 5.2.x before 5.2.3

Description The issue is caused by a buffer overflow in the vararg functions in ldo.c, allowing context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments. This can be exploited by a remote attacker using a large number of variable-length arguments.

Recommendations For Lua versions 5.1 through 5.2.x before 5.2.3, update to version 5.2.3 or later to resolve the issue. As a temporary workaround, consider restricting the number of arguments passed to functions with a large number of fixed arguments to minimize the risk of exploitation.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2014-2137

AZL-41108

AZL-45036

BDU:2015-04141

BDU:2015-04142

CVE-2014-5461

DLA-47-1

DSA-3015-1

DSA-3016-1

MGASA-2014-0414

OPENSUSE-SU-2025:15247-1

USN-2338-1

Affected Products

Alt Linux

Lua

Ubuntu

References · 39

• 🔥 http://openwall.com/lists/oss-security/2014/08/21/1 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2014/08/21/4 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2025:15247-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2014-09/msg00030.html · Vendor Advisory
• https://security.gentoo.org/glsa/201701-53 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-5461 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0414.html · Security Note
• http://lua.org/bugs.html#5.2.2-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-5461 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2015:144 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2338-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-5461 · Security Note
• https://ubuntu.com/security/CVE-2014-5461 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0414 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04142 · Security Note