CVE-2020-24372

2020-08-1717:15:13

Debian Security Bug Tracker

security-tracker.debian.org

luajit security vulnerability

out-of-bounds read

lj_err_run

unix

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

45.3%

JSON

LuaJIT through 2.1.0-beta3 has an out-of-bounds read in lj_err_run in lj_err.c.

OSVersionArchitecturePackageVersionFilename
Debian12allluajit<= 2.1.0~beta3+git20220320+dfsg-4.1luajit_2.1.0~beta3+git20220320+dfsg-4.1_all.deb
Debian11allluajit<= 2.1.0~beta3+dfsg-5.3luajit_2.1.0~beta3+dfsg-5.3_all.deb
Debian999allluajit<= 2.1.0+openresty20240815-1luajit_2.1.0+openresty20240815-1_all.deb
Debian13allluajit<= 2.1.0+openresty20240815-1luajit_2.1.0+openresty20240815-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	luajit	<= 2.1.0~beta3+git20220320+dfsg-4.1	luajit_2.1.0~beta3+git20220320+dfsg-4.1_all.deb
Debian	11	all	luajit	<= 2.1.0~beta3+dfsg-5.3	luajit_2.1.0~beta3+dfsg-5.3_all.deb
Debian	999	all	luajit	<= 2.1.0+openresty20240815-1	luajit_2.1.0+openresty20240815-1_all.deb
Debian	13	all	luajit	<= 2.1.0+openresty20240815-1	luajit_2.1.0+openresty20240815-1_all.deb