CVE-2022-28805

singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer ov...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami lua

[{"type":"SEMVER","events":[{"introduced":"5.4.0"},{"fixed":"5.4.5"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Alpine Linux ALPINE-CVE-2022-28805 lua5.4 Corrigé dans: 5.4.3-r1
Debian DEBIAN-CVE-2022-28805 lua5.4

Références

advisory lists.fedoraproject.org
advisory lists.fedoraproject.org
advisory security.gentoo.org
advisory nvd.nist.gov
advisory github.com
patch github.com
web lua-users.org
web lua-users.org
web lua-users.org