CVE-2020-15945 — Improper Input Validation in LUA

CWE-20 — Improper Input Validation13 documents8 sources
Severity
5.5MEDIUMNVD
OSV6.4
EPSS
0.2%
top 63.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
13
LUAOpensc Project OpenscDebian Lua5.1+10 more
Timeline
PublishedJul 24
Latest updateJun 30

Description

Lua 5.4.0 (fixed in 5.4.1) has a segmentation fault in changedline in ldebug.c (e.g., when called by luaG_traceexec) because it incorrectly expects that an oldpc value is always updated upon a return of the flow of control to a function.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages13 packages

▶NVDlua/lua5.3.1 — 5.4.0
▶debiandebian/lua50< lua5.4 5.4.1-1 (bookworm)
▶debiandebian/lua5.1< lua5.4 5.4.1-1 (bookworm)
▶debiandebian/lua5.2< lua5.4 5.4.1-1 (bookworm)
▶debiandebian/lua5.3< lua5.4 5.4.1-1 (bookworm)

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
OSV
opensc vulnerabilities↗2022-06-08
▶
GHSA
GHSA-4fp8-99qh-27p3: Lua through 5↗2022-05-24
▶
OSV
CVE-2020-15945: Lua 5↗2020-07-24
▶

📋Vendor Advisories

3
Microsoft
Lua through 5.4.0 has a segmentation fault in changedline in ldebug.c (e.g. when called by luaG_traceexec) because it incorrectly expects that an oldpc value is always updated upon a return of the flo↗2020-07-14
▶
Red Hat
lua: segmentation fault in changedline in ldebug.c↗2020-07-09
▶
Debian
CVE-2020-15945: lua5.1 - Lua 5.4.0 (fixed in 5.4.1) has a segmentation fault in changedline in ldebug.c (...↗2020
▶

📄Research Papers

1
arXiv
Threat Assessment in Machine Learning based Systems↗2022-06-30
▶

💬Community

5
Bugzilla
CVE-2020-15945 compat-lua: lua: segmentation fault in changedline in ldebug.c [fedora-all]↗2020-07-31
▶
Bugzilla
CVE-2020-15945 compat-lua: lua: segmentation fault in changedline in ldebug.c [epel-all]↗2020-07-31
▶
Bugzilla
CVE-2020-15945 lua: segmentation fault in changedline in ldebug.c [fedora-all]↗2020-07-30
▶
Bugzilla
CVE-2020-15945 lua: segmentation fault in changedline in ldebug.c↗2020-07-30
▶
Bugzilla
CVE-2019-15945 opensc: Out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c↗2019-10-24
▶
CVE-2020-15945 — Improper Input Validation in LUA | cvebase