[SECURITY] Fedora 32 Update: prosody-0.11.8-1.fc32

Prosody is a flexible communications server for Jabber/XMPP written in Lua. It aims to be easy to use, and light on resources. For developers it aims to be easy to extend and give a flexible system on which to rapidly develop added functionality, or prototype new protocols...

[SECURITY] Fedora 33 Update: prosody-0.11.8-1.fc33

Prosody is a flexible communications server for Jabber/XMPP written in Lua. It aims to be easy to use, and light on resources. For developers it aims to be easy to extend and give a flexible system on which to rapidly develop added functionality, or prototype new protocols...

lua:fuzz_lua: Heap-buffer-overflow in luaG_runerror

Project: https://github.com/lua/lua.git Detailed Report: https://oss-fuzz.com/testcase?key=6568794421067776 Project: lua Fuzzing Engine: afl Fuzz Target: fuzzlua Job Type: aflasanlua Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x6030000042e7 Crash State: luaGrunerror...

NoSQL Redis Heap Buffer Overflow DoS

The vulnerability of the getnum function implementation in the NoSQL Redis database management system arises from a potential integer overflow. Exploiting this vulnerability could allow an attacker to cause service failures or execute arbitrary code using the scripting language Lua...

Huawei EulerOS: Security Advisory for lua (EulerOS-SA-2021-1154)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : lua (EulerOS-SA-2021-1154)

According to the version of the lua packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal3,2^31.CVE-2020-24370 Not...

CentOS 8 : lua (CESA-2019:3706)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3706 advisory. - lua: use-after-free in luaupvaluejoin in lapi.c resulting in denial of service CVE-2019-6706 Note that Nessus has not tested for this issue but has instead...

lua:fuzz_lua: Heap-buffer-overflow in luaH_newkey

Detailed Report: https://oss-fuzz.com/testcase?key=5648938650697728 Project: lua Fuzzing Engine: libFuzzer Fuzz Target: fuzzlua Job Type: libfuzzerasanlua Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6170000010b8 Crash State: luaHnewkey luaVfinishset luaVexecute...

OSV-2021-205 Heap-use-after-free in lua_closeslot

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29610 Crash type: Heap-use-after-free WRITE 1 Crash state: luacloseslot luaLtraceback msghandler...

PT-2021-28008

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-use-after-free error, which occurs when the program attempts to access memory that has already been freed. The crash state...

lua:fuzz_lua: Heap-use-after-free in lua_closeslot

Project: https://github.com/lua/lua.git Detailed Report: https://oss-fuzz.com/testcase?key=6225249693728768 Project: lua Fuzzing Engine: libFuzzer Fuzz Target: fuzzlua Job Type: libfuzzerasanlua Platform Id: linux Crash Type: Heap-use-after-free WRITE 1 Crash Address: 0x61800000ba38 Crash State:...

Medium: vim

Issue Overview: A flaw was found in vim in the restricted mode, where all commands that make use of external shells are disabled. However, it was found that users could still execute some arbitrary OS commands in the restricted mode. This flaw was fixed by filtering the functions that can call OS...

lua:fuzz_lua: Heap-buffer-overflow in luaV_execute

Detailed Report: https://oss-fuzz.com/testcase?key=5686664175419392 Project: lua Fuzzing Engine: libFuzzer Fuzz Target: fuzzlua Job Type: libfuzzerasanlua Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x617000000358 Crash State: luaVexecute luaDcallnoyield...

CVE-2020-25757

A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system command APIs, resulting in arbitrary command execution with root privileges. This affects DSR-150, DSR-250, DSR-500, and DSR-1000AC with firmware 3.14 and 3.17...

CVE-2020-25757

A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system command APIs, resulting in arbitrary command execution with root privileges. This affects DSR-150, DSR-250, DSR-500, and DSR-1000AC with firmware 3.14 and 3.17...

Input validation

A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system command APIs, resulting in arbitrary command execution with root privileges. This affects DSR-150, DSR-250, DSR-500, and DSR-1000AC with firmware 3.14 and 3.17...

CVE-2020-25757

A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system command APIs, resulting in arbitrary command execution with root privileges. This affects DSR-150, DSR-250, DSR-500, and DSR-1000AC with firmware 3.14 and 3.17...

CVE-2020-25757

CVE-2020-25757 affects D-Link DSR-series VPN routers (DSR-150, DSR-250, DSR-500, DSR-1000AC) running firmware 3.14 and 3.17. The root cause is inadequate input validation and access controls in Lua CGI handlers, allowing user-supplied data to reach system command APIs (os.popen) and enabling arbi...

CVE-2020-25757: Improper Input Validation

A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system command APIs, resulting in arbitrary command execution with root privileges. This affects DSR-150, DSR-250, DSR-500, and DSR-1000AC with firmware 3.14 and 3.17...

Cisco IOS XE Lua Interpreter Code Execution

The vulnerability of the Lua interpreter used in Cisco IOS XE operating systems is related to insufficient restrictions on function calls. Exploiting this vulnerability allows an attacker to execute arbitrary code with root privileges...