NULL Pointer Dereference Vulnerability in Lua 5.4.0
CVE-2020-24369

7.5HIGH

Key Information:

Vendor

Lua

Status
Lua
Vendor
CVE Published:
17 August 2020

What is CVE-2020-24369?

In Lua 5.4.0, a vulnerability exists in ldebug.c where an attempt to access debug information via the line hook of a stripped function can lead to a NULL pointer dereference. This issue could potentially disrupt the normal operation of applications using this version of Lua, allowing for unexpected behavior or crashes.

References

https://www.lua.org/bugs.html#5.4.0-12
x_refsource_MISC
https://github.com/lua/lua/commit/ae5b5ba529753c7a653901f...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.