Use-After-Free Vulnerability in Lua 5.3.5 from Lua Project
CVE-2019-6706

7.5HIGH

Key Information:

Vendor

Lua

Status
Lua
Vendor
CVE Published:
23 January 2019

What is CVE-2019-6706?

Lua 5.3.5 contains a use-after-free vulnerability within the lua_upvaluejoin function located in lapi.c. An attacker can exploit this flaw by triggering a specific debug.upvaluejoin call that exploits the relationships of the provided arguments, potentially leading to a crash of the Lua interpreter.

References

http://packetstormsecurity.com/files/151335/Lua-5.3.5-Use...
https://github.com/Lua-Project/cve-analysis/blob/a43c9ccd...
https://github.com/lua/lua/commit/89aee84cbc9224f638f3b79...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.