CVE-2021-44964
CVE-2021-44964
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a crafted script file.
CVSS 6.3 · Medium · EPSS 1.0% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
lua5.4 Debian:12
- Affected ranges
- ECOSYSTEM: < 5.4.4-1
Update to 5.4.4-1
lua5.4 Debian:13
- Affected ranges
- ECOSYSTEM: < 5.4.4-1
Update to 5.4.4-1
lua5.4 Debian:14
- Affected ranges
- ECOSYSTEM: < 5.4.4-1
Update to 5.4.4-1
lua5.2 Ubuntu:14.04:LTS
- Versions
- 5.2.2-1
- 5.2.2-2
- 5.2.2-3
- 5.2.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
lua5.2 Ubuntu:16.04:LTS
- Versions
- 5.2.4-1
- 5.2.4-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
lua5.3 Ubuntu:16.04:LTS
- Versions
- 5.3.1-1
- 5.3.1-1ubuntu2
- 5.3.1-1ubuntu2.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
lua50 Ubuntu:16.04:LTS
- Versions
- 5.0.3-7
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
lua50 Ubuntu:18.04:LTS
- Versions
- 5.0.3-8
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
lua50 Ubuntu:20.04:LTS
- Versions
- 5.0.3-8build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- http://lua-users.org/lists/lua-l/2021-11/msg00186.html
- http://lua-users.org/lists/lua-l/2021-12/msg00007.html
- http://lua-users.org/lists/lua-l/2021-12/msg00015.html
- http://lua-users.org/lists/lua-l/2021-12/msg00030.html
- https://github.com/Lua-Project/lua-5.4.4-sandbox-escape-with-new-vulnerability
- https://nvd.nist.gov/vuln/detail/CVE-2021-44964