OESA-2022-1632

Dashboard / Vulnerabilities / OESA-2022-1632

OESA-2022-1632

Summary: lua security update

Details: Lua is a powerful, efficient, lightweight, embeddable scripting language. It supports procedural programming, object-oriented programming, functional programming, data-driven programming, and data description. Security Fix(es): singlevar in lparser.c in Lua through 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.(CVE-2022-28805) Lua 5.4.4 and 5.4.2 are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.(CVE-2021-44647)

References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1632, https://nvd.nist.gov/vuln/detail/CVE-2022-28805, https://nvd.nist.gov/vuln/detail/CVE-2021-44647