CVE-2020-15889

Опубликовано: 21 июл. 2020

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members.

Ссылки

http://lua-users.org/lists/lua-l/2020-07/msg00078.html
Exploit
Mailing List
Third Party Advisory
http://lua-users.org/lists/lua-l/2020-12/msg00157.html
Mailing List
Third Party Advisory
https://github.com/lua/lua/commit/127e7a6c8942b362aa3c6627f44d660a4fb75312
Patch
Third Party Advisory
http://lua-users.org/lists/lua-l/2020-07/msg00078.html
Exploit
Mailing List
Third Party Advisory
http://lua-users.org/lists/lua-l/2020-12/msg00157.html
Mailing List
Third Party Advisory
https://github.com/lua/lua/commit/127e7a6c8942b362aa3c6627f44d660a4fb75312
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:lua:lua:5.4.0:*:*:*:*:*:*:*

EPSS

Процентиль: 66%

0.0051

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-125

Связанные уязвимости

CVE-2020-15889

CVSS3: 9.8

ubuntu

больше 5 лет назад

Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members.

CVE-2020-15889

CVSS3: 8.1

redhat

больше 5 лет назад

Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members.

CVE-2020-15889

CVSS3: 9.8

msrc

больше 5 лет назад

Описание отсутствует

CVE-2020-15889

CVSS3: 9.8

debian

больше 5 лет назад

Lua 5.4.0 has a getobjname heap-based buffer over-read because youngco ...

GHSA-j29r-h8wr-v5v8

github

больше 3 лет назад

Lua through 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members.

EPSS

Процентиль: 66%

0.0051

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-125