PT-2020-14728 · Lua+1 · Lua+1

Roberto-Ieru · Published 2020-07-24 · Updated 2025-08-03 · CVE-2020-15945

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Lua versions prior to 5.4.1

Description The issue is related to a segmentation fault in the changedline function in ldebug.c, which can be triggered when luaG traceexec is called. This occurs because the code incorrectly assumes that the oldpc value is always updated when the flow of control returns to a function.

Recommendations For Lua versions prior to 5.4.1, update to version 5.4.1 or later to resolve the issue.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

AZL-40818

AZL-6671

BDU:2025-08605

BIT-LUA-2020-15945

CVE-2020-15945

OPENSUSE-SU-2024:11029-1

OPENSUSE-SU-2025:15401-1

ROSA-SA-2025-2620

Affected Products

Lua

Red Os

References · 26

• 🔥 http://lua-users.org/lists/lua-l/2020-07/msg00123.html · Exploit
• https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3 · Patch
• https://security-tracker.debian.org/tracker/CVE-2020-15945 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15945 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-6671 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15945 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-15945 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-40818 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08605 · Security Note
• https://osv.dev/vulnerability/BIT-lua-2020-15945 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15401-1 · Vendor Advisory
• https://redos.red-soft.ru/support/secure/uyazvimosti/uyazvimost-lua-cve-2020-15945/?sphrase_id=1076746 · Note
• https://t.me/cvenotify/48752 · Telegram Post
• https://suse.com/security/cve/CVE-2020-24371 · Note
• https://lua.org/bugs.html#5.4.0-8 · Note