CVE-2022-28805
singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer ov...
Original description
The description as published by the source.
singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.
Affected packages
Bitnami
lua
[{"type":"SEMVER","events":[{"introduced":"5.4.0"},{"fixed":"5.4.5"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2022-28805 lua5.4 Fixed in: 5.4.3-r1
- Debian DEBIAN-CVE-2022-28805 lua5.4
References
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory security.gentoo.org
- advisory nvd.nist.gov
- advisory github.com
- patch github.com
- web lua-users.org
- web lua-users.org
- web lua-users.org