Bastien Roucariès pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
a2d671e4 by Bastien Roucariès at 2023-06-25T21:06:43+00:00
CVE-2021-43519: document first vulnerable commit
Stack overflow was likely introduced by commit Oct of 12, 2020, that refactor
cororoutine and remove (line 688) stack overflow checking:
if (getCcalls(L) >= LUAI_MAXCCALLS)
This will need more testing by using POC but likely some version are not
affected
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -122910,6 +122910,7 @@ CVE-2021-43519 (Stack overflow in lua_resume of ldo.c
in Lua Interpreter 5.1.0~5
NOTE: http://lua-users.org/lists/lua-l/2021-10/msg00123.html
NOTE: http://lua-users.org/lists/lua-l/2021-11/msg00015.html
NOTE: Fixed by:
https://github.com/lua/lua/commit/74d99057a5146755e737c479850f87fd0e3b6868
(v5.4.4)
+ NOTE: Likely introduced by
https://github.com/lua/lua/commit/287b302acb8d925178e9edb800f0a8d18c7d35f6
CVE-2021-43518 (Teeworlds up to and including 0.7.5 is vulnerable to Buffer
Overflow. ...)
- teeworlds 0.7.5-2 (bug #1009070)
[bullseye] - teeworlds <no-dsa> (Minor issue)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a2d671e483592f0cb97ba2e4ac250b37ca9ac1fa
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a2d671e483592f0cb97ba2e4ac250b37ca9ac1fa
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
