197 matches found
CVE-2024-25176
LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in ljstrfmtwfnum in ljstrfmtnum.c...
CVE-2024-25178
LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an out-of-bounds read in the stack-overflow handler in ljstate.c...
CVE-2024-25178
LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an out-of-bounds read in the stack-overflow handler in ljstate.c...
CVE-2024-25178
LuaJIT through version 2.1 and OpenRusty luajit2 before v2.1-20240314 are vulnerable to an out-of-bounds read in the stack-overflow handler located in lj_state.c . This memory safety issue can be triggered by incorrect handling of certain inputs, potentially leading to a system crash or denial of...
LuaJIT 安全漏洞
LuaJIT is a LuaJIT open source on-the-fly compiler for the Lua language. A security vulnerability exists in LuaJIT 2.1 and earlier versions, which stems from a stack buffer overflow in the ljstrfmtwfnum function in ljstrfmtnum.c. The vulnerability is caused by a stack buffer overflow in the...
CVE-2024-25176
LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in ljstrfmtwfnum in ljstrfmtnum.c...
CVE-2024-25176
LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in ljstrfmtwfnum in ljstrfmtnum.c...
CVE-2024-25177
LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IRFSTORE for NULL metatable, which leads to Denial of Service DoS...
CVE-2019-19391
In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue that leads to arbitrary memory write or read operations, because certain cases involving valid stack levels and options are mishandled. NOTE: The LuaJIT project owner states that...
PT-2025-28637 · Git +1 · Tarantool
Name of the Vulnerable Software and Affected Versions: luajit affected versions not specified Description: The software contains a heap-buffer-overflow read issue. The crash state involves lj buf ruleb128, lj bcread, and cpparser. Recommendations: At the moment, there is no information about a...
K000150505: LuaJIT vulnerabilities CVE-2019-19391, CVE-2020-15890, CVE-2020-24372
Security Advisory Description CVE-2019-19391 In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue that leads to arbitrary memory write or read operations, because certain cases involving valid stack levels and options are mishandled...
Linux Distros Unpatched Vulnerability : CVE-2019-19391
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue that leads to arbitrary memory write or re...
Linux Distros Unpatched Vulnerability : CVE-2020-15890
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LuaJit through 2.1.0-beta3 has an out-of-bounds read because gc handler frame traversal is mishandled. CVE-2020-15890 Note that Nessus relies on the presence of...
PT-2025-20013 · Git +1 · Tarantool
Name of the Vulnerable Software and Affected Versions: LuaJIT affected versions not specified Description: The LuaJIT software contains a heap-buffer-overflow vulnerability. The crash occurs within the lj strfmt pushvf function, which is called by err msgv and lj err msg. Recommendations: At the...
CVE-2024-39702
In ljstrhash.c in OpenResty 1.19.3.1 through 1.25.3.1, the string hashing function used during string interning allows HashDoS Hash Denial of Service attacks. An attacker could cause excessive resource usage during proxy operations via crafted requests, potentially leading to a denial of service...
CVE-2024-39702
The OpenResty web application server (versions 1.19.3.1 through 1.25.3.1 ) is vulnerable to a HashDoS (Hash Denial of Service) attack due to a flaw in the string hashing function located in lj_str_hash.c. This vulnerability specifically affects the OpenResty fork in the openresty/luajit2 GitHub r...
In LuaJIT through 2.0.5 as used in Moonjit before 2.1.2 and other products debug.getinfo has a type confusion issue that leads to arbitrary memory write or read operations because certain cases involving valid stack levels and > options are mishandled. NOTE: The LuaJIT project owner states that the debug libary is unsafe by definition and that this is not a vulnerability. When LuaJIT was originally developed the expectation was that the entire debug library had no security guarantees and thus it made no sense to assign CVEs. However not all users of later LuaJIT derivatives share this perspective
...
Mysterious 'Sandman' Threat Actor Targets Telecom Providers Across Three Continents
A previously undocumented threat actor dubbed Sandman has been attributed to a set of cyber attacks targeting telecommunication providers in the Middle East, Western Europe, and the South Asian subcontinent. Notably, the intrusions leverage a just-in-time JIT compiler for the Lua programming...
SUSE CVE-2019-19391
In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue that leads to arbitrary memory write or read operations, because certain cases involving valid stack levels and options are mishandled. NOTE: The LuaJIT project owner states that...