tarantool:luaL_loadbuffer_fuzzer: Index-out-of-bounds in parse_chunk

Project: https://github.com/tarantool/tarantool.git Detailed Report: https://oss-fuzz.com/testcase?key=6283570354651136 Project: tarantool Fuzzing Engine: libFuzzer Fuzz Target: luaLloadbufferfuzzer Job Type: libfuzzerubsantarantool Platform Id: linux Crash Type: Index-out-of-bounds Crash Address...

OESA-2024-2169 lua security update

Lua is a powerful, efficient, lightweight, embeddable scripting language. It supports procedural programming, object-oriented programming, functional programming, data-driven programming, and data description. Security Fixes: ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault...

CVE-2024-42503 Authenticated Remote Command Execution (RCE) Vulnerability in the Lua Package Within the AOS Command Line Interface (CLI)

Authenticated command execution vulnerability exist in the ArubaOS command line interface CLI. Successful exploitation of this vulnerabilities result in the ability to run arbitrary commands as a priviledge user on the underlying operating system...

CVE-2024-45413

The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in rsadecrypt function. This function is an API wrapper for LUA to decrypt RSA encrypted ciphertext, the decrypted data is stored on the stack without checking its length. An authenticated attacker can get RC...

RHSA-2023:2582 Red Hat Security Advisory: lua security update

Bulletin has no description...

RHSA-2023:1211 Red Hat Security Advisory: lua security update

Bulletin has no description...

RHSA-2023:0957 Red Hat Security Advisory: lua security update

Bulletin has no description...

RHSA-2022:7329 Red Hat Security Advisory: lua security update

Bulletin has no description...

RHSA-2021:4510 Red Hat Security Advisory: lua security update

Bulletin has no description...

RHSA-2019:3706 Red Hat Security Advisory: lua security and bug fix update

Bulletin has no description...

CVE-2024-45413

The HTTPD binary in several ZTE routers contains a stack-based buffer overflow vulnerability within the rsa_decrypt function. This function serves as an API wrapper for LUA to decrypt RSA encrypted ciphertext, but it fails to verify the length of the decrypted data before storing it on the stack....

CVE-2024-45413

The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in rsadecrypt function. This function is an API wrapper for LUA to decrypt RSA encrypted ciphertext, the decrypted data is stored on the stack without checking its length. An authenticated attacker can get RC...

tarantool:luaL_loadbuffer_fuzzer: Crash in parse_chunk

Project: https://github.com/tarantool/tarantool.git Detailed Report: https://oss-fuzz.com/testcase?key=5091141278564352 Project: tarantool Fuzzing Engine: libFuzzer Fuzz Target: luaLloadbufferfuzzer Job Type: libfuzzerasantarantool Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

CVE-2024-45597

Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. Scripts passing user-controlled values to http.request header values are affected. An attacker could use this to send arbitrary requests, potentially leveraging authentication tokens provided in the same headers table...

CVE-2024-45597 Pluto's http.request allows CR and LF in header values

Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. Scripts passing user-controlled values to http.request header values are affected. An attacker could use this to send arbitrary requests, potentially leveraging authentication tokens provided in the same headers table...

CVE-2024-45597 Pluto's http.request allows CR and LF in header values

Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. Scripts passing user-controlled values to http.request header values are affected. An attacker could use this to send arbitrary requests, potentially leveraging authentication tokens provided in the same headers table...

CVE-2024-45597

Pluto (a Lua-based superset) is affected by CVE-2024-45597 due to scripts passing user-controlled values to http.request header values, which can allow an attacker to send arbitrary HTTP requests and potentially leverage authentication tokens in the same headers table. The issue is tied to header...

CVE-2024-45597 Pluto's http.request allows CR and LF in header values

Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. Scripts passing user-controlled values to http.request header values are affected. An attacker could use this to send arbitrary requests, potentially leveraging authentication tokens provided in the same headers table...

Fedora: Security Advisory (FEDORA-2024-430678b035)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-a84c59eedc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...