CVE-2022-28805
- State
- Published
- Severity
- Not scored
- Published
- Apr 8, 2022
- Updated
- Aug 3, 2024
- Reserved
- Apr 8, 2022
Description
singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://lua-users.org/lists/lua-l/2022-02/msg00001.html
- https://lua-users.org/lists/lua-l/2022-02/msg00070.html
- https://lua-users.org/lists/lua-l/2022-04/msg00009.html
- https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa
- FEDORA-2022-b9ed35a7advendor-advisory
- FEDORA-2022-5b5889f43avendor-advisory
- GLSA-202305-23vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.