CVE-2019-19391 — Type Confusion in Project Moonjit
Severity
9.1CRITICALNVD
EPSS
0.2%
top 58.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 29
Latest updateMay 24
Description
In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue that leads to arbitrary memory write or read operations, because certain cases involving valid stack levels and > options are mishandled. NOTE: The LuaJIT project owner states that the debug libary is unsafe by definition and that this is not a vulnerability. When LuaJIT was originally developed, the expectation was that the entire debug library had no security guarantees and thu…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2
Affected Packages9 packages
Patches
🔴Vulnerability Details
3📋Vendor Advisories
2Microsoft▶
In LuaJIT through 2.0.5 as used in Moonjit before 2.1.2 and other products debug.getinfo has a type confusion issue that leads to arbitrary memory write or read operations because certain cases involv↗2019-11-12
Debian▶
CVE-2019-19391: luajit - In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, deb...↗2019