CVE-2022-28805

Name
CVE-2022-28805
Description
singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.
NVD Severity
high
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://lua-users.org/lists/lua-l/2022-02/msg00001.html
MISC https://lua-users.org/lists/lua-l/2022-02/msg00070.html
MISC https://lua-users.org/lists/lua-l/2022-04/msg00009.html
MISC https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJNJ66IFDUKWJJZXHGOLRGIA3HWWC36R/
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UHYZOEFDVLVAD6EEP4CDW6DNONIVVHPA/
GENTOO https://security.gentoo.org/glsa/202305-23
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RJNJ66IFDUKWJJZXHGOLRGIA3HWWC36R/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UHYZOEFDVLVAD6EEP4CDW6DNONIVVHPA/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:lua:lua:*:*:*:*:*:*:*:* lua >= None <= 5.4.4
cpe:2.3:a:lua:lua:*:*:*:*:*:*:*:* lua >= 5.4.0 < 5.4.4

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
lua5.4 3.15-main 5.4.3-r1 Natanael Copa <ncopa@alpinelinux.org> fixed
lua5.4 3.14-main 5.4.3-r1 Natanael Copa <ncopa@alpinelinux.org> fixed