CVE-2015-8080
Fixed in a distro release EPSS 5%
Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow.
Products: redislabs redis, debian_linux, opensuse leap, opensuse, redhat openstack
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | redis | 5.0.5-r1 |
| Alpine 3.11 | redis | 5.0.7-r1 |
| Alpine 3.12 | redis | 5.0.8-r0 |
| Alpine 3.13 | redis | 5.0.8-r0 |
| Alpine 3.14 | redis | 5.0.8-r0 |
| Alpine 3.15 | redis | 5.0.8-r0 |
| Alpine 3.16 | redis | 5.0.8-r0 |
| Alpine 3.17 | redis | 5.0.8-r0 |
| Alpine 3.18 | redis | 5.0.8-r0 |
| Alpine 3.19 | redis | 5.0.8-r0 |
| Debian 12 | redis | 2:3.0.5-4 |
| Debian 13 | redis | 2:3.0.5-4 |
| Debian 14 | redis | 2:3.0.5-4 |
| Debian 8 | redis | 2:2.8.17-1+deb8u3 |
| Red Hat openstack-optools 7 | redis | 0:2.8.24-1.el7ost |
| Red Hat openstack-optools 7 | redis-debuginfo | 0:2.8.24-1.el7ost |
| Red Hat openstack 6 | redis | 0:2.8.24-1.el7ost |
| Red Hat openstack 6 | redis-debuginfo | 0:2.8.24-1.el7ost |
| Red Hat openstack 7 | redis | 0:2.8.24-1.el7ost |
| Red Hat openstack 7 | redis-debuginfo | 0:2.8.24-1.el7ost |
| SUSE Linux Enterprise Module for Server Applications 15 SP2 | redis | 6.0.8-1.3.1 |
| Ubuntu 14.04 LTS | redis | 2:2.8.4-2ubuntu0.2 |
| openSUSE Tumbleweed | redis | 6.2.5-1.2 |