CVE-2014-5461 Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a func...
MediumCVSS 5.0
EPSS 12.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/lua5.1(Debian:12) | < 5.1.5-7 | 5.1.5-7 |
| debian/lua5.1(Debian:13) | < 5.1.5-7 | 5.1.5-7 |
| debian/lua5.1(Debian:14) | < 5.1.5-7 | 5.1.5-7 |
| debian/lua5.2(Debian:12) | < 5.2.3-1 | 5.2.3-1 |
| debian/lua5.2(Debian:13) | < 5.2.3-1 | 5.2.3-1 |
| debian/lua5.2(Debian:14) | < 5.2.3-1 | 5.2.3-1 |
| opensuse | = 12.3 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| lua | = 5.1 | No fix listed |
| lua | = 5.1.1 | No fix listed |
| lua | = 5.1.2 | No fix listed |
| lua | = 5.1.3 | No fix listed |
| lua | = 5.1.4 | No fix listed |
| lua | = 5.1.5 | No fix listed |
| lua | = 5.2.0 | No fix listed |
| lua | = 5.2.1 | No fix listed |
| lua | = 5.2.2 | No fix listed |
| mageia | = 3.0 | No fix listed |
| mageia | = 4.0 | No fix listed |
References
- Debian Security Tracker CVE-2014-5461 vendor-advisory
- advisories.mageia.org third-party-advisory
- openSUSE-SU-2014:1145 third-party-advisory vendor-advisory
- 59890 third-party-advisory
- 60869 third-party-advisory
- 61411 third-party-advisory
- DSA-3015 third-party-advisory vendor-advisory
- DSA-3016 third-party-advisory vendor-advisory
- www.lua.org patch vendor-advisory
- MDVSA-2015:144 broken-link vendor-advisory
- [oss-security] 20140821 CVE request: possible overflow in vararg functions exploit mailing-list patch third-party-advisory
- [oss-security] 20140821 Re: CVE request: possible overflow in vararg functions exploit mailing-list patch third-party-advisory
- [oss-security] 20140827 Re: Lua CVE request [was Re: CVE request: possible overflow in vararg functions] mailing-list third-party-advisory
- 69342 third-party-advisory vdb-entry
- USN-2338-1 third-party-advisory vendor-advisory
- GLSA-201701-53 vendor-advisory
- GLSA-202305-23 vendor-advisory