CVE-2019-6706
Fixed in a distro release EPSS 17%
Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships.
Products: lua, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | lua | 5.3.4-11.el8 |
| AlmaLinux 8 | lua-devel | 5.3.4-11.el8 |
| Alpine 3.10 | lua5.3 | 5.3.5-r2 |
| Alpine 3.11 | lua5.3 | 5.3.5-r2 |
| Alpine 3.12 | lua5.3 | 5.3.5-r2 |
| Alpine 3.13 | lua5.3 | 5.3.5-r2 |
| Alpine 3.14 | lua5.3 | 5.3.5-r2 |
| Alpine 3.14 | lua5.4 | 5.3.5-r2 |
| Alpine 3.15 | lua5.3 | 5.3.5-r2 |
| Alpine 3.15 | lua5.4 | 5.3.5-r2 |
| Alpine 3.16 | lua5.3 | 5.3.5-r2 |
| Alpine 3.16 | lua5.4 | 5.3.5-r2 |
| Alpine 3.17 | lua5.3 | 5.3.5-r2 |
| Alpine 3.17 | lua5.4 | 5.3.5-r2 |
| Alpine 3.18 | lua5.3 | 5.3.5-r2 |
| Alpine 3.18 | lua5.4 | 5.3.5-r2 |
| Alpine 3.19 | lua5.3 | 5.3.5-r2 |
| Alpine 3.19 | lua5.4 | 5.3.5-r2 |
| Alpine 3.20 | lua5.3 | 5.3.5-r2 |
| Alpine 3.20 | lua5.4 | 5.3.5-r2 |
| Alpine 3.21 | lua5.3 | 5.3.5-r2 |
| Alpine 3.21 | lua5.4 | 5.3.5-r2 |
| Alpine 3.22 | lua5.3 | 5.3.5-r2 |
| Alpine 3.22 | lua5.4 | 5.3.5-r2 |
| Alpine 3.23 | lua5.3 | 5.3.5-r2 |
| Alpine 3.23 | lua5.4 | 5.3.5-r2 |
| Alpine 3.24 | lua5.3 | 5.3.5-r2 |
| Alpine 3.24 | lua5.4 | 5.3.5-r2 |
| Alpine 3.6 | lua5.3 | 5.3.5-r2 |
| Alpine 3.7 | lua5.3 | 5.3.5-r0 |
| Alpine 3.8 | lua5.3 | 5.3.5-r2 |
| Alpine 3.9 | lua5.3 | 5.3.5-r2 |
| Chainguard | lua5.4 | 0 |
| Debian 10 | lua5.3 | 5.3.3-1.1+deb10u1 |
| Debian 12 | lua5.3 | 5.3.6-1 |
| Debian 13 | lua5.3 | 5.3.6-1 |
| Debian 14 | lua5.3 | 5.3.6-1 |
| Red Hat Enterprise Linux 8 | lua | 0:5.3.4-11.el8 |
| Red Hat Enterprise Linux 8 | lua-debuginfo | 0:5.3.4-11.el8 |
| Red Hat Enterprise Linux 8 | lua-debugsource | 0:5.3.4-11.el8 |
| Red Hat Enterprise Linux 8 | lua-devel | 0:5.3.4-11.el8 |
| Red Hat Enterprise Linux 8 | lua-libs | 0:5.3.4-11.el8 |
| Red Hat Enterprise Linux 8 | lua-libs-debuginfo | 0:5.3.4-11.el8 |
| Rocky Linux 8 | lua | 0:5.3.4-11.el8 |
| SUSE Linux Enterprise Module for Basesystem 15 | lua53 | 5.3.4-3.3.2 |
| Ubuntu 16.04 LTS | lua5.3 | 5.3.1-1ubuntu2.1 |
| Ubuntu 18.04 LTS | lua5.3 | 5.3.3-1ubuntu0.18.04.1 |
| Wolfi | lua5.4 | 0 |
| openSUSE Leap 15.0 | lua53 | 5.3.4-lp150.2.3.1 |