GoogleOSV:CVE-2020-24342

HistoryAug 13, 2020 - 7:15 p.m.

CVE-2020-24342

2020-08-1319:15:13

Google

osv.dev

6.6 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

50.2%

Lua through 5.4.0 allows a stack redzone cross in luaO_pushvfstring because a protection mechanism wrongly calls luaD_callnoyield twice in a row.

CPENameOperatorVersion
luaeq4.0
luaeq5.0-beta
luaeq5.3-beta
luaeq5.2-alpha
luaeq5.4.0
luaeq2.5
luaeq1.2
luaeq5.1
luaeq5.4-beta
luaeq2.2

Name	Operator	Version
lua	eq	4.0
lua	eq	5.0-beta
lua	eq	5.3-beta
lua	eq	5.2-alpha
lua	eq	5.4.0
lua	eq	2.5
lua	eq	1.2
lua	eq	5.1
lua	eq	5.4-beta
lua	eq	2.2

Rows per page:

1-10 of 421

References

lua-users.org/lists/lua-l/2020-07/msg00052.html

github.com/lua/lua/commit/34affe7a63fc5d842580a9f23616d057e17dfe27

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QA5Q5MDQMTGXRQO3PAQ4EZFTYWJXZM5N/